fb36e4ab7f7d48dc687efc499babe3cfd316f617320a73666e674d0c677dc1f2

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 11:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
Size 31.7MB
Sample260811-njkn9sysb1
SHA256 fb36e4ab7f7d48dc687efc499babe3cfd316f617320a73666e674d0c677dc1f2
MD5 8bf2bc94ff4aac0ecda8eee653006826
SHA1 c4412ad02d5a3c91c5d27563a082d68a96718bea
SHA512 d53d099d2cdf38d0e44643a898b8a8c5d79cbfc2c3d8858d90f417f1b84276238912f8090e1bbe1260f7f79773266b77ccf337a036bc9237e44b92bb5aec1c1b
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+EZ:Wp7V
TLSH
T1CD774B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
404	svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCCBAAACBBBCBCCBBAAAAAABBBBABCCCCACAABBCBCACCAABABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe"	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4772	sc.exe
1112	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4076	cmd.exe
4908	cmd.exe
2384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
404	svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
404	svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
Token: SeDebugPrivilege	404	svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4076	4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe	92
PID 4076 wrote to memory of 2080	4076	cmd.exe	94
PID 4332 wrote to memory of 4908	4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe	95
PID 4908 wrote to memory of 4772	4908	cmd.exe	97
PID 4332 wrote to memory of 2384	4332	2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8bf2bc94ff4aac0ecda8eee653006826_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAACABABBABAAABBCBAAACCBBCCCCBCABBCAAACBAABBBBBCBAABABBBAACCCAACAAAACBBBBABCAABCBACCBCCCBABABBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAACABABBABAAABBCBAAACCBBCCCCBCABBCAAACBAABBBBBCBAABABBBAACCCAACAAAACBBBBABCAABCBACCBCCCBABABBCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe" start= auto displayName= "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe" start= auto displayName= "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB"
  2⤵
  - Executes a command shell one-liner
  PID:2384
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCABAABACBCAABBCAAACBABBBBABBBCCAACBBBACBABBCABCAB"
    3⤵
    - Launches sc.exe
    PID:1112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
1⤵
PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a6caefcb63356b0c7cd3021c71a3f66bb28c835cf4bde6c7403156cbf1834b04
MD5 c860e5b27cf2daab067aefcec2807872
SHA1 ceff49b8f7f596cc48965a1379f785d657a60522
SHA512 97fcbd42f43a6f0f65591c58aea6c1e26bcd49b4bcc61ac43b65f91aca3d3ef31861010aa39926d8b89c9eb63a7ad4a334fa4786af8efd61f6f68d0f0147632a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b77b1ad429a89addd562399f4bd3380e5746c7b1eb8e781e36423a0b6c8492c
MD5 c2d74dd2e51eb3b345e1e15e6c6a1683
SHA1 7b66d16128e2aa9750bf8813b2b3774b2365c42d
SHA512 1bb074b1eae4751e0734c32f2071989fa75e073a2c5d78d62d84ec48214c9ecf3a0d2f63035588957f8e8a462dcd263e5e37577393c3de48b59bf5ce78b3016b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 147c9d4261601b0ac24f1f4eafb7adce8d1d4f45a2422a76960161dae6092a0f
MD5 5ba82e53716524fd5971213deb27a4d4
SHA1 f747cf5881f879eb0019b0aca0b6a8f7f3d6415c
SHA512 006de8c530a78f2a884362fc94b1cd059e489678a85e5d2d522c68e3cfd72c0ab6af61f1af0afb0ebb2a64885f70d5578800d07fdee34e3f4c8ce8d26cba0a51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb28d2599140ad16b8d19d7475bbd4d041b0f47902ab04cb3251978608ba1c90
MD5 962374b434b39002a8a762901fc6dd87
SHA1 35c9bb2aa1d0a8416556c720d2ec5ad8dac58978
SHA512 00af30ee4a078a1c366c02c186902b9dc5e51ec4f9c6ad53d941d38823518952cc38a3f464d08e814c0e70025097226e1fc856c7dadf0372b32e90305aad4b98
MD5 SHA1 SHA512

Submit Download

svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
Size 31.7MB
SHA256 fb36e4ab7f7d48dc687efc499babe3cfd316f617320a73666e674d0c677dc1f2
MD5 8bf2bc94ff4aac0ecda8eee653006826
SHA1 c4412ad02d5a3c91c5d27563a082d68a96718bea
SHA512 d53d099d2cdf38d0e44643a898b8a8c5d79cbfc2c3d8858d90f417f1b84276238912f8090e1bbe1260f7f79773266b77ccf337a036bc9237e44b92bb5aec1c1b
SSDEEP 49152:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+EZ:Wp7V
TLSH
T1CD774B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACACCBACACCCCACBACBCCABBBBBAACBCCCCAACABABABAACACCACBB.exe
Size 1.1MB
SHA256 f24193a216f4a785fcd3de1339ab9c30860d2b4d90c03a65c3f681f2beaaf6f8
MD5 ae093bc3170755fddc78078aa465cd8b
SHA1 3265a987f8b576ccc20981a8ef901203a14b0793
SHA512 c46d14e81080175be1b3cfa79e1b953f7a18c6f2b91fb06f440a049d07dc68d2517557a6f7685d0d9c0316329265d8f325d64288f1f65f20f84488d1df580deb
SSDEEP 24576:m9+EM0cb3bW9+EM0q9+EM0cbD9+EM0q9+EM0q9+EM0q9+EM0cb3bW9+EM0q9+EU:U+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+R
TLSH
T198354B09F94740B1D92B10B04DCBD2BF8A70BB2587128EF7FA4DDB1B7933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/404-25-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/404-38-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/4332-0-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4332-8-0x0000000000890000-0x00000000008B1000-memory.dmp

Download