5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Size 1.5MB
Sample260814-c6ekzsshrc
SHA256 5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a
MD5 fe3372bcd8495b78f0a19270aa111c76
SHA1 e8a0ec298b4a229f3d32b503649ccb37e0582c6a
SHA512 c67eb97e679bce56b62e2c1c7ec6e3a898773ee74821c3a5730955e141740e1a92e9353a9b1c31ad0d0023a7fe0c23975094176edcce5aad3fa0c73c70e22ca1
SSDEEP 24576:m9+EM0q9+EM0q9+EMxIh7CJ69+EM0q9+EM0q9+EMxIh7CJKafDd70iTWCA:U+ES+ES+EFhO6+ES+ES+EFhOrDd79WCA
TLSH
T10A656D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
2360	svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe
3420	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAACAAACCBCACBAABBAABAAABBCCBBBACABCABBCABBBBBCACBBACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe"	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABAAAACBCCBCAACBCBBCBAACBCACCCCCBABBACCBAABCBCBCCACCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe"	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1604	sc.exe
956	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5380	cmd.exe
5464	cmd.exe
2520	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
2360	svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe
2360	svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
Token: SeDebugPrivilege	3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
Token: SeDebugPrivilege	2360	svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5380	4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	93
PID 5380 wrote to memory of 2976	5380	cmd.exe	95
PID 3720 wrote to memory of 5628	3720	svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe	96
PID 4108 wrote to memory of 5464	4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	99
PID 5464 wrote to memory of 1604	5464	cmd.exe	101
PID 4108 wrote to memory of 2520	4108	2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe	102
PID 2520 wrote to memory of 956	2520	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fe3372bcd8495b78f0a19270aa111c76_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAAACCBCAAABCABBCCACBCCCCACBAAAACAABCBCBCCAAACCAABACBBCACBBAACCBAABCCABCBCCACCBCABBBBAAABCBACAABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAAACCBCAAABCABBCCACBCCCCACBAAAACAABCBCBCCAAACCAABACBBCACBBAACCBAABCCABCBCCACCBCABBBBAAABCBACAABAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe" start= auto displayName= "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe" start= auto displayName= "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACBCACBCBACBABABBCCBCBCCBBBCCABBCCBBAACCCBAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBACABCBBABABABCACCAAAABCCBAACCABCAACABBAACCCBAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
1⤵
- Executes dropped EXE
PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 89b072eeb202efc2ef9d8dc741c6920a96a6bd8f179c011a07455a6fe43d0250
MD5 8db26b9706bb5266e488817fc0600b0a
SHA1 cfaf1195f573dd5d3fe02242455c6ebe963b0e99
SHA512 0d86aaad97aed0d7ad42812f5ff0a269786a9dfe76086c9b239e8106fdcb1629b607981c8a6105340ae08fecd2df0db60754b912e858d39896216739da644ca4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85e17aae1220e93bd98c2fb928701fb0c673369099f2d2b3b44ef6f7a00083bc
MD5 0e8d3c5cd2869221153058664eba3a89
SHA1 7568687cfc125c8066c8223e3975d42970bc917c
SHA512 d67efea1949d1564b1323a67dd11cdf3cfec069f20041ca8042292867aeb537e8676ab7db478f567d99595b6fc0e947187abaccfc0da8564fcb31281b76c5026
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5bf1059a0adba87304e67f44180a07a96d0b8cadbaab4b50b04b16199ae28091
MD5 0e76bfb17c788d6608e9034b404d91e1
SHA1 7e8141df0df2dafee18ffeaabfb8581e1658424e
SHA512 b0a3d3a93cbc0c69aa550e7dbe19c8e05ddb52080b1e9ee9663829f7e8ee536d9ce78f21609a29ee0becee21d33013478962c3ecfb04ac3f3c133d3440f57246
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88e0fb606c90354fbaf0bc3d9387e1f1a5b5939a5542ab38accb3d02fe4a21be
MD5 16b460a782f6eb72e50d5d1ab12105ce
SHA1 8f63aa8797527aa6138e4f08d6f20a48ba7454a7
SHA512 db8de859f08259704ad80b2f9955698dbc587d502eac4d2ba7235c0ed9a7f4ae5a06019ab2372e21027ae31f041384371e33f5f104a0d5fdb95221f76bc16afe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 148a5b7d22d1e47daf5b7fb25a09e7ed7febb0d9e22f1261d460661643c02fc5
MD5 19b3f3e90ad29530e16f9c4e15c524b5
SHA1 266c11b6a073d1ca5db443650408bef4edeb72ba
SHA512 e872c86445d2c0c64babd6c6d36736ed3a9fb8af6bc9305048a10d56ba35589c03ca9bc399cde105e909ec3b520d8075aa6888de8784e1843dd8b8db942b8cf3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a1682e7f0c88ab7a09c8fb345fb7427f14d5fdf308c3f1c818ad9cc14cf256dc
MD5 1cf3e2b20c6f772d61828dffc0aedc05
SHA1 3242c49e791cf1c7ed108435f1d54cabc9ce292b
SHA512 0e5eb7dc1804e9defd5a5190efda45a78158daf4c0773f55202bfb84791ae6433b6c7e40c495ea68bc58c4e0d597f923197dda5a664ebba7cb80835602c0fc6c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2e512d6592c767e1bdc2a37603d8ba1a0e9d2e664d762216830c8ad42c6b4131
MD5 d7e6ee0812db6f87a23d54b62aecc25b
SHA1 165b30ff98d86e8fd3e4d21bba3060b18a29fd59
SHA512 a9ee309aa18c67a378c574401b455f98ef545f2153b4e79808add625204e5bd753ba56bb6e56af833ca60685a5401b84c06770aa77d92bfbf8f4988fd7edc394
MD5 SHA1 SHA512

Submit Download

svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABCCCBCACCABBBAABCABCABCACBBCCBBBAABAABABCBABBCCAACA.exe
Size 1.5MB
SHA256 5d1f95b202ec204b49eda76ce6159f8e6f8f07c7ee0c9798b461b0a2222e980a
MD5 fe3372bcd8495b78f0a19270aa111c76
SHA1 e8a0ec298b4a229f3d32b503649ccb37e0582c6a
SHA512 c67eb97e679bce56b62e2c1c7ec6e3a898773ee74821c3a5730955e141740e1a92e9353a9b1c31ad0d0023a7fe0c23975094176edcce5aad3fa0c73c70e22ca1
SSDEEP 24576:m9+EM0q9+EM0q9+EMxIh7CJ69+EM0q9+EM0q9+EMxIh7CJKafDd70iTWCA:U+ES+ES+EFhO6+ES+ES+EFhOrDd79WCA
TLSH
T10A656D08B6D640B5E577557089ABC27A893579314B21CADFE3C8C63E9E33BD0B934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0e5ade96963ff85f2bb783bf4e63fe6d030438e40c5229fb24483b3261953311
MD5 aba048e91c99a30c9ec47f365a507618
SHA1 600963848b8fea5f9cc104027a150b65f5dcc44b
SHA512 61cd917c82a0b8cb74878175716d0222ed3d4a3cccf275ac80be50326a81c46b18f5d24fc643e90da3c3917b2c93cca0065f65773056f390e9f732ccbe763987
TLSH
T136110451A4F5CC17A923688B952AEB620CB475AFEC2CEA44530D41286BC9C30CE154FA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2360-65-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/3720-34-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4108-0-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/4108-8-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download