569b09b37c2b2ec8fbd592cfaab7a946943ff6aec0949490084d0fde3ee547e9

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
Size 37.6MB
Sample260812-ajrwpafm21
SHA256 569b09b37c2b2ec8fbd592cfaab7a946943ff6aec0949490084d0fde3ee547e9
MD5 1084309c61498ee3305785a7f612dd89
SHA1 b4cae2e2d56582f6129b90a4e5ef61b703cc10fa
SHA512 cc83f810b66bd78853aaa069eb40460643ae67a4d8f2d00c01486415de17db2b3c74947c89d4ff7d3c20abe7e2d25de5d38504eb72b3665edeb21376c6fa20dd
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Ex:hp7bp7bp7S
TLSH
T1BE875B09F94340B1D92B50B04DCBD2BF8A70BB2587128EE7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
3700	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
4496	svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACAAABABCBCBABCAACAACBBBCABABCCBBCCBBAABBCCBCBCCAACCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe"	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACAABBCAAAACAACAABABCAAABBCCBAABCCBCABCBBBBBBAABCBCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe"	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4080	sc.exe
3928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe
4024	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
4496	svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe
4496	svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
Token: SeDebugPrivilege	1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
Token: SeDebugPrivilege	4496	svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4176	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4428	2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe	109
PID 4428 wrote to memory of 4160	4428	cmd.exe	111
PID 1032 wrote to memory of 1848	1032	svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe	113
PID 2320 wrote to memory of 4024	2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe	114
PID 4024 wrote to memory of 4080	4024	cmd.exe	116
PID 2320 wrote to memory of 1136	2320	2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe	117
PID 1136 wrote to memory of 3928	1136	cmd.exe	119
PID 1848 wrote to memory of 1624	1848	notepad.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1084309c61498ee3305785a7f612dd89_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBBBBBACBCCAAAABCAABCABBBCABBCACCACBABCABBACBBABABACBCBCABBBCBBBBACABABAABCCCBCAAABCCBCCCAAACACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBBBBBACBCCAAAABCAABCABBBCABBCACCACBABCABBACBBABABACBCBCABBBCBBBBACABABAABCCCBCAAABCCBCCCAAACACABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe" start= auto displayName= "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe" start= auto displayName= "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABBACACCACAABABBBCAAABBCCABCBCBCBBCCCCBAACCAACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1848
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBBAAAAACABCCCACCBCBCCCAABAAABAACCACAACCBBBBCCAAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a4bc0476c13bec9244ea094faafdf61dbe8702171a14553d11815ab35b278ec
MD5 46cc8bed22bb4e166a996b37c953d822
SHA1 c8ff856aba94d02499208a8c095be43a44af5cc0
SHA512 7a306a6ed8ea2e2af614b680e196889d550280d45fa107f835c3dd35c72971aad139f9888736f5bc99aaa3e7fb81cee9970966656b8915a074bb4d191bfd73f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74d93cf432d972a47bf563b37209109eb2e2754f53754af0a69cb6a768117c88
MD5 84d16b9ab499bffaa0b786999eb9637d
SHA1 43f987ca60efc957d4d5d0e83e525f55fab3eb25
SHA512 e4b5edd946382fd471a7587deccd7446fcaf9c3d8f894bbfec27325a67063fd59a5dae4bdc111293858670fbee51b515bcfd1d20f6c88e2c7bcafb67ea78df22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1b7758c55e23b38cb9df54133f455463cef0dd1dc43289b86c1087f50160e53
MD5 b8af00a4b4b00a3d2b75177fb8a73bd6
SHA1 0dfeccef8b641c46dee57d9e49317a935c6c677c
SHA512 8b322d68202c64d98ab0104c51c470e157f6f8fe476dcafd8ea718d4904253e6c87aeda324a9abeb27fd632e3bf884e6532f6cf2a32cd2b424b92954d39b072c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d7c518e653c7014ce0b18f8ea73680d578f7d3e11783d0f0473ff2a05a3490e7
MD5 2c71c0c390e76c494d88ffe446d7d30f
SHA1 613b4cd4cbbc0c29ee831a8ad4f428f844295745
SHA512 8145e877da78954b9dc761efc40d188c93e8d3b5a4f2733201b3fefa6d4e4f54e1ad94dfb02b50923f04f1c1c968f0ade59038f24a41b480bb4c5a52528f4392
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 47e1b8a6ae810171398aeff056ba64ffa3022aec48489b7915cbeebdc7ac6b65
MD5 97aafac01784415693040326a3ecdc65
SHA1 c588514753a1bb7d21f2f6b5f64e6104fca62f0e
SHA512 b101fc4d60247b512d6eacbfe4c824551212e67385001f8e7d24ecf050adaf432509099656685064eeb47f0fa180dfa0fb877b8a38e39fc8f172db93e7369883
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 24268fd903676ff35f0a3c1998b84eed741875f507f3f70100304a2e1905742d
MD5 c1af9e8662df9dfe23faf39ce5b73467
SHA1 8c41376fbfea4a1917673ee5cfbca5b11d181e7a
SHA512 7ac71b0c3305946d8dd230ccc6138568b76aa075b93e236deb179832610b3fa84cde8a48c14efe47ba4ce3eeb64e9751d40062290447a5cda7646df25d0377be
MD5 SHA1 SHA512

Submit Download

svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBAABCCCCACCCBBAABCCCAAACCCABBCCCBABBACAAABBBAAAAB.exe
Size 37.6MB
SHA256 569b09b37c2b2ec8fbd592cfaab7a946943ff6aec0949490084d0fde3ee547e9
MD5 1084309c61498ee3305785a7f612dd89
SHA1 b4cae2e2d56582f6129b90a4e5ef61b703cc10fa
SHA512 cc83f810b66bd78853aaa069eb40460643ae67a4d8f2d00c01486415de17db2b3c74947c89d4ff7d3c20abe7e2d25de5d38504eb72b3665edeb21376c6fa20dd
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Ex:hp7bp7bp7S
TLSH
T1BE875B09F94340B1D92B50B04DCBD2BF8A70BB2587128EE7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 a345752721181e2b75cb963c055a8387b08a1a33273a763a2616158901e14e71
MD5 d9b76a3bb942206ec3ecbb67ad68cb52
SHA1 bd59d0949c826ca39bc7294d04cc872a971cc883
SHA512 965e167ac35ad2cedb54c5b16537d34697d74f61c07d663f96694b6da39dd3e35e4fabd0b12e00402acd8dc4e01686784091137d43cb5ae5eb96fdab0cd4427e
TLSH
T1EA019B70E4B6D423E9337CDF913DABD70DD4378B6CB85A08634481196B84C229E298FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-25-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/1032-38-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/1848-66-0x00000000030C0000-0x00000000030C1000-memory.dmp

Download

memory/2320-6-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3700-74-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/4496-89-0x0000000000320000-0x0000000000341000-memory.dmp

Download