2864f09e51a7e7ed36f1177925d63008318955932cfd927f7b934abef7a95364

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
Size 10.9MB
Sample260813-e7apja1hqc
SHA256 2864f09e51a7e7ed36f1177925d63008318955932cfd927f7b934abef7a95364
MD5 773532b5a02f2d02501b4dbc6d1d2c72
SHA1 ca899c256e7c9caf98ee950c1709c86b2cd1fba4
SHA512 07edb3b5ebacad762431e61ff1b27bfd0a53ac5bf6f0daa683fad7fb05d3eb52689fb58ae9fb7213068a6930d0349d068595b066c52806a0ea74a051fb928b2e
SSDEEP 49152:U+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+E4:1p7i
TLSH
T176B63B09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
892	svchost_AACABCBCBCCCCACABBAACBABCCBACCCBCBACBCCACACABBCACCABBBA.exe
4840	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCCCBBBBBCABBACBBAAACACCACBBCACBAABACABBBBBCBCABCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe"	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBBABCBCBCBAABCCABBCCCACCBCBCACBACACCCBBACACBBCBCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACABCBCBCCCCACABBAACBABCCBACCCBCBACBCCACACABBCACCABBBA.exe"	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5580	sc.exe
4876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3408	cmd.exe
3552	cmd.exe
4772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACABCBCBCCCCACABBAACBABCCBACCCBCBACBCCACACABBCACCABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
Token: SeDebugPrivilege	5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4772	3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe	92
PID 4772 wrote to memory of 4888	4772	cmd.exe	94
PID 5620 wrote to memory of 4272	5620	svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe	95
PID 3384 wrote to memory of 3408	3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe	98
PID 3408 wrote to memory of 5580	3408	cmd.exe	100
PID 3384 wrote to memory of 3552	3384	2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe	101
PID 3552 wrote to memory of 4876	3552	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_773532b5a02f2d02501b4dbc6d1d2c72_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCCBAAABBCABCACABCABBBACBBAACABCBCCACABBACBACBCBBCBACBCACCABBAACCBBBCBBACCACCCBAABCBAAABBCBCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBAACCCBAAABBCABCACABCABBBACBBAACABCBCCACABBACBACBCBBCBACBCACCABBAACCBBBCBBACCACCCBAABCBAAABBCBCBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe" start= auto displayName= "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe" start= auto displayName= "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACABACCABBCBBACCCCBCCAACCAABAABCBCAABBBBBCCCBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCBCCCCACABBAACBABCCBACCCBCBACBCCACACABBCACCABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACABCBCBCCCCACABBAACBABCCBACCCBCBACBCCACACABBCACCABBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
1⤵
- Executes dropped EXE
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 20a8aaef27e79e64383d415cde0bb917eaedc2282dcb31d8f4294b9c855cb90a
MD5 71c3e04b98d1d69f35b99e7f169cc6dc
SHA1 7954917286fc98f0f939a262df3bf8433453c853
SHA512 1f14615a8faa91b7389c107be8eb8549107142054615af7dfb61055e22ee97eed5dc446b18090c387ecf2f84b6b439008b9bc70787af303ad1c4e7fad0831807
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c09e3da4d17b403adfcf2fd79e52a8d8eca4e825298c71bbf52e1466b2e307be
MD5 d218d305a7a6b82150b85766aa335bf7
SHA1 c0f19468b25c6e69ae3573ac32e7fdbbe64be3f6
SHA512 84f93e6b718e1e4bddc390a071a06d699dc478683299c122227fc3ef382753e25bd3924a5291bde355e8f44e4d3594e23df8f1c33b5491b9f7095f5872e53066
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b28699fa44e077676082359c78fbf934ce12dcb2532b8cd2b617909de050a1d1
MD5 96e8ae5b5cd580754987b985ef1370be
SHA1 cc50757e037f5371958875d125c59620a19a7e4e
SHA512 8fb33a580dd1c51a6d8552cd250614f6e35ae568acb4d5a2c56e1e6b7fa9e822eed56fecf17f3725765b2aca02d76331ebdd5bc55b34fe4bc229dee4102d5e19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f1cb222573fb6247f19ffaeefeb2cb5540f410b7d0c8ac12ae0e2591cbd20bae
MD5 71b101b4ce0eb2bc79bc9f1e092420b8
SHA1 89edf445905d2cdea3011c4a193d1480b161e4c6
SHA512 6ceef841cb9d4c167368d6494a691e0cde0ffa7c7526e1d5efa346fa983c49a2cf06c200bec75c0f695aa842ebafbf6c2c2b613e0d334972845004b4804dd6e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee5b1a01966024c7310226845fc6941bed6dc57aaa3b718f79fa6c9ba2629886
MD5 8751f3d39b963eb4ad388a36610e38fb
SHA1 164e2357259e196ba865a45ac52d41cd80c39138
SHA512 a50a9bd71151a8135cd01d4afb2578674f69b6928441eaefa2dce917058182401a3e4a599ed0c18b73a78d6677cb8702b35c534df8e742f1ead3bcccbfc49081
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 512KB
SHA256 78a5caec19be3bcf0257638d7d82a9747075b778e5cef87f88ec0511681d9711
MD5 0edfa25d682ca7db9122e9dda610348d
SHA1 29a3bf54e6e3de8e0b80c17372fe7889ec5107d3
SHA512 5edc78c8647deba877da22a4fb44079e2484e363f6cfc72d8985daff7d9b610df356e2e648bb78def5ab8461c3af5c9a0b3901c096739e9f887c82f4ffae2e5c
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUagUFgEsnojA9gUFga:m9+EM0q9+EM0q9+EM0q9+EM0q9a9+EM5
TLSH
T1FFB40909F94340B1DD2B50F04DCBE3BF8A60AB25C6128EF7FB4DCB5BA523BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 66.0MB
SHA256 2010c81968fad6dfb7c5a640ab7b5cf7e51feb7e12f418402c3eaf9d14e80135
MD5 de896bbd5c0b8bae5243251727c988c3
SHA1 c98eb309f572a568cfc2a85b408b9fa9d316d728
SHA512 a47dd099e792683d6f6fbb2cbc5931db6add663f3a516699596ffd1d5497ac1e6e10366e8b9594d53531bcfaf0595dca13cf02772a0a22dea31d04b1d6f51e11
SSDEEP 49152:U+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+Ew:1p7Kp7Kp7Kp7Kp7Kp7g2cyoG
TLSH
T11BE73C09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 11171bf20f8e6d93fe6206a6d2a5821cff0517da12617fb1e723e4615490cafb
MD5 03b632d428d2d9c6bec3b9c294ed804c
SHA1 63652aa5df4f1a951687d3d25aca2456141a0999
SHA512 2642340ffda0579ed6e770960627392ea720fa899541c6bc8353e6e1dd90e12f741d922b35d0721c71087088a12725a9f7168a0452885815638edc65b0a45aaf
MD5 SHA1 SHA512

Submit Download

svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACACBCABABBCBABBBABBAAAAABABBBCABAAAABCBAABAACABBBC.exe
Size 10.9MB
SHA256 2864f09e51a7e7ed36f1177925d63008318955932cfd927f7b934abef7a95364
MD5 773532b5a02f2d02501b4dbc6d1d2c72
SHA1 ca899c256e7c9caf98ee950c1709c86b2cd1fba4
SHA512 07edb3b5ebacad762431e61ff1b27bfd0a53ac5bf6f0daa683fad7fb05d3eb52689fb58ae9fb7213068a6930d0349d068595b066c52806a0ea74a051fb928b2e
SSDEEP 49152:U+ES+ES+ES+ESY+ES+E2+ES+ES+Euq+ES+ES+EN+E2+ES+ES+ES+ESY+ES+E2+E4:1p7i
TLSH
T176B63B09F94340B1D92B51B04DCBD3BF8A20BB2586128EFBFB4DC75BA933B916438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-85-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/3384-23-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3384-49-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3384-0-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3384-71-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3384-12-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/5620-48-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/5620-70-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/5620-93-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download