9b3245ed040fe02d692b3f18b84b5321f4fd18a016449d391b3ab36f6458e8e5

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
Size 5.1MB
Sample260812-adn8ls1yfs
SHA256 9b3245ed040fe02d692b3f18b84b5321f4fd18a016449d391b3ab36f6458e8e5
MD5 34cdf89a878d83571d3a7bf278796147
SHA1 5b416684f4b765ff14fcdeb1f16561609d9fdea0
SHA512 743a2e5b5991ec1cc28ef0557238b3dab4d8e9426162561679518c57beef960c67d438d7511955b668ebde8eec3be510418d59d6695c3175481c0658467c1cd0
SSDEEP 49152:U+EW5+ES+ES+ES+EWmhOW+ES+ES+EW5+ES+ES+ES+EW5+ES+ES+ES+EWmhOSL+Ep:k/n/wp7+
TLSH
T162466C09F58740B1E97751704DDBD2BE8930BA2187228EEBF689C63F6933BD16834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
4704	svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe
5184	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBCBCACACBCBCCABAABABCCABCBAABAABACBCCCAAACCBBABABCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe"	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBACAACBCAACACCBCABBBBBBCCBCCABCAABABCCCCCCBAACACBBAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe"	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4264	sc.exe
1056	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5432	cmd.exe
2364	cmd.exe
2596	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
4704	svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe
4704	svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
Token: SeDebugPrivilege	2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
Token: SeDebugPrivilege	4704	svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 5432	700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe	92
PID 5432 wrote to memory of 3940	5432	cmd.exe	94
PID 2516 wrote to memory of 2164	2516	svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe	95
PID 700 wrote to memory of 2364	700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe	98
PID 2364 wrote to memory of 4264	2364	cmd.exe	100
PID 700 wrote to memory of 2596	700	2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe	101
PID 2596 wrote to memory of 1056	2596	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_34cdf89a878d83571d3a7bf278796147_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAACBBCAAABBBCACCACBABACCACCBBACACBBBAABBCACBAACAACCCCABCAACCABAABBCACCCAAAAABBAABAACCACBACACBBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAACBBCAAABBBCACCACBABACCACCBBACACBBBAABBCACBAACAACCCCABCAACCABAABBCACCCAAAAABBAABAACCACBACACBBBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe" start= auto displayName= "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe" start= auto displayName= "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCAACBCACABAAACCAACACCACABABCCAABABAAAACABCBABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2164

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAABBBBBCACCCBACACAABBABAACAABBAABBBBCCBABBCACBCBBACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
1⤵
- Executes dropped EXE
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1457b7797e3d5d028ee250a0e7e3568acf5064cf217131e109b9088a5fdcdb10
MD5 7efec8b78166692c21b5da855f50f137
SHA1 fd90fd24c200228c3e95c56563d81e76cf9a070d
SHA512 026d15290b5b7ea3dd269b88f793349ba5ff91a22e56bf48c95771363f288598ab1f2df1e43ca885b1d02424a32533a5eaafb70e7ce65ba4fc181446d0834a51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56be9ef4db18c7d4f270936d836158315994a0459d49422d1bd5c1d3195ee0c2
MD5 1800060a373917cc79b6a45a7325e134
SHA1 a55dd4bd42c5d396358fd349289c3ccb4814edd2
SHA512 6f53e529f20340317fa5c61ceb4c7081390fde48566dc466c69377412575c7bbd3a5761b33c8ca282099006ca54892a4ea4d42e5490aabcce9d408062b616668
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 977be84557e49ace4a22fb270e14327f2d059a7a6b8f51f613bfb354db15db66
MD5 6eeaee9dff119b5f349ff194474380f7
SHA1 135f717ab8b984a719484a453e9b85d4f09e12c0
SHA512 a93b016f074c32f68d7c519be29130f2fa8f2f8d0853bd8a0dd0b92cb82a5dec21b66bc8fc89df736bfe9dd4deb27c92ff69e00bb685ca198dc5d102bae988f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4436463a5614b9a31f2287c881ca184c39c312a668960957eeb02948666b404e
MD5 4bb7f2996228643809e0a69d3ce9e02b
SHA1 8e9aa340b8d9956d5a84286f5f01bee891f42423
SHA512 58df1fb6c37e1cdce10a80ea9b66d3445f5fafe83c63e1484761bc489cdc3fd743afd96f68c0b4a3a781782522751e2f6b8feeb9f40fc8a0c5d4eab4c9f1d986
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 146662d7dd461a49a9b47dcabd959d031875b362f9989bc0604d80fe25f6a475
MD5 6e5bbfaf29b2433183957944dfc3dbdd
SHA1 96720a781fd6810f4c5662556a8459df115bc38f
SHA512 6c1d6b9298b1c18ee27cdfc22680e515ca4353fac6e9f13cc9e040f6ddd9d39a3a096b8b41ed4ddac69a3ac4a431dc56bb1e6b8d4983330a03291f328481e8e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 784d3ecc39828ae7fd94c175dc685a436aa3bd25bd11233a8c4fedfa682e9f62
MD5 05d151984888ee9d99a42b5c95a352d1
SHA1 47cf8420ca4c8b09eec4e307b1e5de4e26442b2d
SHA512 1814007213def7cef3c2c603febc9472857b2f39f1f0cc5d8fa21ab9253ec14f6c371f119d814d2397c74c364797619d96d9da5d5765f9734e5a1929fd6e73eb
MD5 SHA1 SHA512

Submit Download

svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCBACBBCACACCABCBCCABBCBBAABACCABBCBCBACACACBBAAAA.exe
Size 5.1MB
SHA256 9b3245ed040fe02d692b3f18b84b5321f4fd18a016449d391b3ab36f6458e8e5
MD5 34cdf89a878d83571d3a7bf278796147
SHA1 5b416684f4b765ff14fcdeb1f16561609d9fdea0
SHA512 743a2e5b5991ec1cc28ef0557238b3dab4d8e9426162561679518c57beef960c67d438d7511955b668ebde8eec3be510418d59d6695c3175481c0658467c1cd0
SSDEEP 49152:U+EW5+ES+ES+ES+EWmhOW+ES+ES+EW5+ES+ES+ES+EW5+ES+ES+ES+EWmhOSL+Ep:k/n/wp7+
TLSH
T162466C09F58740B1E97751704DDBD2BE8930BA2187228EEBF689C63F6933BD16834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 9efae933a03b784fffdc3dca13608555d72ec5fc66b734f4b42822c31820f329
MD5 3ea7461589c029fbeae2bc0a45487a6e
SHA1 e2114586d22dfc63d1a5bd9367316911cb0e3354
SHA512 d3a51c01a45746b7e8173194b14049ea3cd8d12deb10b69cdbf411f7b14b0f3d6f7feea4344160caba68b2860180f3af3f6e644700c766f6091c59d1ab684e1e
TLSH
T10E01C87094EAD893EC33B497B619DBD70998359B58AC6A04224C5219F7C5C324D154F9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-8-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/700-0-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/2516-24-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/2516-34-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4704-79-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download