35f044582dbe0922e1e73bd2b758f0fb4e264fbe206ab61ea500224ea7e2c24f

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
Size 18.5MB
Sample260813-e9fcsszydy
SHA256 35f044582dbe0922e1e73bd2b758f0fb4e264fbe206ab61ea500224ea7e2c24f
MD5 70aab8ce0effa541eba830ce1dfd0763
SHA1 b9d0d49a5bb7f7d503703b02814c6a1bfe76e16d
SHA512 8c606231a0a7eab97a7ee65318a993ea1423a04146674f9c27e7f7eee5c0a0028c40860834c46f342440755b5618eb0cdcb1aeb374d2db7c51ac6972d609ddbf
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EWM:Qp7V
TLSH
T18E174B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
724	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
3924	svchost_CCBCCBCCCCBAACBABBBABAABAABBAABBBBCBBAAAAABCCACACBCBCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBCABBBBCABCABAAABBCABCCBCBBCAABBCABAACAAABCABCBBCABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe"	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBAACABACACBBAAACBBBBCABBAAACAACABAACBCAABABBBBAAACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCBCCCCBAACBABBBABAABAABBAABBBBCBBAAAAABCCACACBCBCBC.exe"	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4984	sc.exe
2148	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5016	cmd.exe
1028	cmd.exe
2916	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCBCCCCBAACBABBBABAABAABBAABBBBCBBAAAAABCCACACBCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
Token: SeDebugPrivilege	3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1532	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 5016	952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe	99
PID 5016 wrote to memory of 1628	5016	cmd.exe	101
PID 3656 wrote to memory of 3996	3656	svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe	102
PID 952 wrote to memory of 1028	952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe	104
PID 1028 wrote to memory of 4984	1028	cmd.exe	106
PID 952 wrote to memory of 2916	952	2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe	107
PID 2916 wrote to memory of 2148	2916	cmd.exe	109
PID 3996 wrote to memory of 584	3996	notepad.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_70aab8ce0effa541eba830ce1dfd0763_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCACBCACACBACCBBBACCCCBBACCCBBAACBBBABCBBABBCCAAABBABCCCBBACCABBCACACBABCCACACCACBABABBCBBBCBBBCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABCACBCACACBACCBBBACCCCBBACCCBBAACBBBABCBBABBCCAAABBABCCCBBACCABBCACACBABCCACACCACBABABBCBBBCBBBCBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe" start= auto displayName= "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe" start= auto displayName= "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBBCABAABCAACCCCCCBAACAACABBABBACBBBACABBCBACBCACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
1⤵
- Executes dropped EXE
PID:724

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBCCCCBAACBABBBABAABAABBAABBBBCBBAAAAABCCACACBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBCCCCBAACBABBBABAABAABBAABBBBCBBAAAAABCCACACBCBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b524195096f908a077231f178f3b33bce7b220743df211bed9a3fbe2a757c73
MD5 216843854e04e10efdd83123d64f694f
SHA1 621317fc5fd19898314c921956d23fc6ce5e5af7
SHA512 69998fc7fdd36e844ed73f2865f4a972ce9c8855e8926f44613009af54339dcd411daed6e90d243d620aee4ab0ce3677ba32e19ba4163f029f8d6ec1c8431de6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ca306bc4deb162aa8f6aeed67d690ad443bd19453e7b76a2eceb4effab834c0
MD5 c7af1033f603f7e001b0043f1753c110
SHA1 f3244404250ab4ef843c83741133f1853b97a514
SHA512 610876ad411743c81881bde0e8bda38362bd5f9e15eb3863350bff1aeb55509cba23109da97c91b4137b4a0d6dfba946e3c120aa8cf15030f543493a134bd2d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0d188c081feaaead47470d9ea3cc167acf9b7cd9020fb5300fd8bfcfbc392ec7
MD5 f2bb8ffd00596f1cadc3133112ce8147
SHA1 af3bfcdeb7f717aa86ba3d5dc22b86311ce06980
SHA512 7a3ba9b2eb52d6f564d516754928a4320d5542e12b0744a08f4fd786ee02a7fdace0102c9728dfa521e803c3c977a61af72f487a84888bde9fffb11470da7e70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 557c0755bb9b4322480f227a39781ad37e703c5f04aa53bcb591e5d39a2e5696
MD5 bdfdea70d30af4ea175e84b9bcd40c82
SHA1 57336292f445cb5c0d550eefc402e647791ad39c
SHA512 55a02fe564bc0c5395f51d5cf0507f33791db883fe3c17407b911ef435649ad232e72dd5b25ac26209c66251689bb6017075c50de7bb6502b2e9c2c79c8655f6
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBAAACAACBBCBCBBACBAACABCBABBACCABBCCCCABABBCBBCBBAC.exe
Size 18.5MB
SHA256 35f044582dbe0922e1e73bd2b758f0fb4e264fbe206ab61ea500224ea7e2c24f
MD5 70aab8ce0effa541eba830ce1dfd0763
SHA1 b9d0d49a5bb7f7d503703b02814c6a1bfe76e16d
SHA512 8c606231a0a7eab97a7ee65318a993ea1423a04146674f9c27e7f7eee5c0a0028c40860834c46f342440755b5618eb0cdcb1aeb374d2db7c51ac6972d609ddbf
SSDEEP 49152:U+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EWM:Qp7V
TLSH
T18E174B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/952-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/952-7-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/3656-27-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3656-40-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3996-67-0x0000000002870000-0x0000000002871000-memory.dmp

Download