33b1675a867ecaa1dc9cb2f74312bf7a6649b7885e0721b16e0ee868febe1df4

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 15:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
Size 663KB
Sample260812-s38bwsar3x
SHA256 33b1675a867ecaa1dc9cb2f74312bf7a6649b7885e0721b16e0ee868febe1df4
MD5 ffe1fdecdecf084b84d5cf733a06ac51
SHA1 fa040bb20e4e2b3ed25a794b8222ee6358fb4d56
SHA512 46056ff160350031258e6726c07e6699dbdb50734815949a5f45ff5d2775758d4d6cf01f90058d67912f6dec57ed7609e18caaf284fd4e6f100802549874a74b
SSDEEP 12288:mgUFgEsnojAD+BeDuAxha0wIk0BX3RKuemGd70ioGuVWW6oIt:m9+EM0GEGvafDd70iTWCt
TLSH
T1A1E46B01B7D180B5F0B329318ABF9739553ABC715F3486CFA388562E5E72AD0A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
4812	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
5800	svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABABBCACBABCBBAAACBACBBBABACBCCACACAABBACCBABAABCAAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe"	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCCCACCACCCCCBCCBACCCACBCCCABBCCCBBACACCBABCBACACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe"	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5300	sc.exe
2240	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5944	cmd.exe
3384	cmd.exe
5940	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
5800	svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe
5800	svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
Token: SeDebugPrivilege	5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
Token: SeDebugPrivilege	5800	svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5944	2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe	92
PID 5944 wrote to memory of 2388	5944	cmd.exe	94
PID 2584 wrote to memory of 3384	2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe	95
PID 3384 wrote to memory of 5300	3384	cmd.exe	97
PID 2584 wrote to memory of 5940	2584	2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe	98
PID 5940 wrote to memory of 2240	5940	cmd.exe	100
PID 5200 wrote to memory of 5316	5200	svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_ffe1fdecdecf084b84d5cf733a06ac51_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAAABACACCACAABBACACBABABBACAABCBBBAAACCCABCBABBCCCBCCABAABCCCCAACABBCAABBBCBAACACCBBCCCACBCCAAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCAAABACACCACAABBACACBABABBACAABCBBBAAACCCABCBABBCCCBCCABAABCCCCAACABBCAABBBCBAACACCBBCCCACBCCAAAACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe" start= auto displayName= "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe" start= auto displayName= "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCCCBAAAABABBBAABABABACABBBABAABBAAACBCBBABBABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
1⤵
- Executes dropped EXE
PID:4812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACCAABBCCBBCCCAACCBBBAAABCACABACACCBCAABABBCBABCBCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a2d17883982c0ab2512da722758ec537e4ce2eb3382da67f08d5361919712168
MD5 3109cbe49cdb82d948973a43e87b0705
SHA1 466ce71ef356a0d413ea314fcac29fc9574041bf
SHA512 7b000613ed29af377d86af55fa9c8993f0cd19c056862b7034d18526a3bda68e89aca0329b19126bac779c384ab753ce6a6a2fac2b2b9c890d885a0fa85abd10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86953a2652a6b819cb023adbb2d80912de6c88392838e3297930388b22020400
MD5 d19d634217ac6d6fdaf2ac4ca71843c6
SHA1 38b5b735f62afd635e20d0e96e5cfd9c3ca2aa94
SHA512 57ca8eda17d850478114680f6fe9df54bcfda82c25c63554907c74f2875dd985125d9cd843c7ba57830d77b22228242197ac9b692b9c69a56bd583c3eb6edb60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 604a08c338f0f5665a573dd7efa02a7cd874478cbc120c8a689eee557024f93d
MD5 08b96ddec4ab86f7d69f6fe1c44abf26
SHA1 2faf7bbbd713fef488455d9d41c5e1b3ec1e919b
SHA512 cebe8b8300e10c8606594600742be2f947adc41e4fba531504ae0f025000872fdebaf0cddbc56e2811846c3636d8be9ce23c1ad429a17f8fef01f421164a3ded
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7ab270d4e10d6cafc6e1edf9503a5d1805b0f7268fbcc14ad597da9b32223d2e
MD5 4da1e1f05c23e0976a3b3d562b2fa994
SHA1 7a386fd1a6cdf4c3c4c48e86331c810e0a6795c7
SHA512 1dac76d4e34e2c10628a5ec2ac21289aabc3fb156569599a140e19e846dcbe5a26f763e3ae961e9e4d4b2764220b3b26c6e007d2af1bb718bf63355d8def7f0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a84de9fefbfc5fe8dc1f5a9057dddf5b41e41b4498a3beeac47e370181811443
MD5 e71d0f820df338df11bd39a82d0bf113
SHA1 15bf5d11aaf81fc826dcd0da95591cdd5fd28eec
SHA512 6997f1da8b4a07a8e4554aadbd365a12a885eeba1d4533472fc161f721a37f2ac9725510e25f297eda8234b3ad220dfef8b0f59938d842b8306d51d1032a9e2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c07c8c127dd210160841266b2e2bf6aca5c676e6a6fcce67cb76eb8a92e480a8
MD5 1dd17d1f2b6b3630033c18f806dd34c4
SHA1 e9e1de1b2efb4187fa7100514dd1bb255264b502
SHA512 4355c6e2c7a5313151e1d3c39647b0823feeb9066c86200ee9181751d6eb36f2d0a5a49d830aedc64aea17b14251e905628afbf2754d630b36deac64b9555372
MD5 SHA1 SHA512

Submit Download

svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAAABCCAABCBACCCCCCCBABCBACABCBBBBABACABACCABACBCBBB.exe
Size 663KB
SHA256 33b1675a867ecaa1dc9cb2f74312bf7a6649b7885e0721b16e0ee868febe1df4
MD5 ffe1fdecdecf084b84d5cf733a06ac51
SHA1 fa040bb20e4e2b3ed25a794b8222ee6358fb4d56
SHA512 46056ff160350031258e6726c07e6699dbdb50734815949a5f45ff5d2775758d4d6cf01f90058d67912f6dec57ed7609e18caaf284fd4e6f100802549874a74b
SSDEEP 12288:mgUFgEsnojAD+BeDuAxha0wIk0BX3RKuemGd70ioGuVWW6oIt:m9+EM0GEGvafDd70iTWCt
TLSH
T1A1E46B01B7D180B5F0B329318ABF9739553ABC715F3486CFA388562E5E72AD0A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 498a2d3a291e0889a12f42c1cecaa2b1129335317ddceddecadac07a8a1c2f50
MD5 2cfa355f2c732a75940783f4e3bd8675
SHA1 03a8a0def4c71dd024dc005754e9f9624d3317b5
SHA512 5d341ae207f2b77117840fce47baabf1c7a3c535357c8d7aec06886bd2d1648bf5844d263157e0710a7e8432c4c4cb2c92955c90b2bf82d98e58c0e2f4992bcc
TLSH
T159112E1894E6D82BE972BCCFA219CB860CA437FB58A85E0423458518B7CDC32DD560E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2584-6-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4812-66-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/5200-22-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/5200-35-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/5800-72-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download