06f5bd30e09f34c7fa3c1c871abf118b0ad794dd0da9789fb0b6fdc0fabee021

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
Size 5.4MB
Sample260814-dypawstepd
SHA256 06f5bd30e09f34c7fa3c1c871abf118b0ad794dd0da9789fb0b6fdc0fabee021
MD5 b6ae5e47b3ed531e41c2ae7c2db0be23
SHA1 b5ea657b08e7dd905a9684f162bbf8d19b521a58
SHA512 87f4d038698fb24cc975608c88875ee43f8c7e7108c2f30bfe6829fe413d2f9ee102b5329b9771acc872f9336ccd07c6644fd3b81569fd7a0c05334f9d3eabab
SSDEEP 49152:U+ES+Ez8obnyMWGhO/+Ez8obnyMWT+ES+Ez8obnyMWGhO4iw21+ES+Ez8obnyMWx:frBOr/rBZrBOr/rBTp7B
TLSH
T189466C0E22FC00B5D8BF9175D6A58265C671B43127329ADFA290C73D9F6B9D1A83CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
4660	svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe
4268	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABBAABCBABCBCCCAACAAACCCCACAAACBBCBBCBABCCCABBBAACACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe"	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBACCCAAACBACCCCCCCBCCBBAACACACACAACCCCBBBCBBBBCABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe"	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3844	sc.exe
4796	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3460	cmd.exe
3684	cmd.exe
5064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
4660	svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe
4660	svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
Token: SeDebugPrivilege	1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
Token: SeDebugPrivilege	4660	svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1076	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3460	560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe	100
PID 3460 wrote to memory of 4232	3460	cmd.exe	102
PID 1744 wrote to memory of 2356	1744	svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe	103
PID 2356 wrote to memory of 4592	2356	notepad.exe	104
PID 560 wrote to memory of 3684	560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe	108
PID 3684 wrote to memory of 3844	3684	cmd.exe	110
PID 560 wrote to memory of 5064	560	2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe	111
PID 5064 wrote to memory of 4796	5064	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b6ae5e47b3ed531e41c2ae7c2db0be23_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACAABCAABABCBACAAABBBAABACACCCBCCCBBCBAABCBCCAAACAAACCBBABBACCBBCAACBCACBABBBCCABCCABBCCBCCABCBBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACAABCAABABCBACAAABBBAABACACCCBCCCBBCBAABCBCCAAACAAACCBBABBACCBBCAACBCACBABBBCCABCCABBCCBCCABCBBCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe" start= auto displayName= "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe" start= auto displayName= "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABCACABACBACABACABAACBBBACCABBBBCBABBBBCABCCBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABBBBBCAABCBBCCBBBCBAABBBBCAABACABCCAABBCCBAACCBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
1⤵
- Executes dropped EXE
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c923b23d7928a432f28c7097e8443a7ad991ad0870e0f3703912a83f289df216
MD5 325691092f039b55e2b623879a424e28
SHA1 81ac000aa1b461b1452583da9194fa7cb48f573a
SHA512 7473e4e8f42286f67aba98a3affbd0dbfc59431d665ae5fcf8fb3f8d27cb33e19f9994a9a74ee103ff46b6972902bde3b9a9fd0ccae70e4aab8c5ca95291413e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3792c50f2809f1096db79102f15b8e2b4ecd65277202d1b714407215bc43d132
MD5 5e49ee7b6b5d837d5aaed73dc6d57c24
SHA1 39e5500d46b5243f92ebdbf15f7afca00aa9b074
SHA512 955b1354ecf1b38013844c29b74db70901eba855e39692eedca7fea9ce323f30fb1ba57edfd2b86c7280bad379a22887f922ad849c953f65df85b129b931c68b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d0c74123e3f77c8a6f916a2cbca1981fa024c4d52f62c95962ee53f162e43eb
MD5 a0503d2034085acef64b072a2e262569
SHA1 111a7800e03ce0b01364c921a8e0af142359ba56
SHA512 9528c50963e11c9e8f0f20828836169496014c3400b8ec356b7cc58af2cd1c296901f4e83e157b3164a7a031695d4c221f4f6048a5c69bfb1523f680495ef471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a20c2bb8ff51f74923104bb49c330280923df5210ff22599b5b6c8e409fe326d
MD5 f727244809583efc83f03093293bf325
SHA1 5ef692272ee5a0c7e971d05c714b1210ef4278b8
SHA512 12cfaf37b32ce6ebae56e8c2836a46185264b30c4258ea7967ef8f1557f39e3265a2c4e8050e2d2786018dd92ab8b7fd2242283420e3074330ef99ad1e63cc02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ab0ce7f65086b28e35bc165a0fc28e26b3f5cda4bf3de4bbbb1710e240008bb
MD5 62e4c15c20862ab6af57caca2d173e13
SHA1 41278827b60f7dda9cd4c3d5bb01f1660e901407
SHA512 d7926b3a665cf42c85b090fa3bcf7a5fae680c49858524efeb59579b1a77901b5cf32953e27b1c8e87e881eee9d527a5b8ab4067feeeca0f7e693dc162000886
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c17b8df6afdf98031b1c6df2d5d79f52241b51075a00eb1e799455efb46613df
MD5 4702734afad53925fd8454c9ca6ef78d
SHA1 bd53f22ad2d4d8d44a65044bbdd2791ec042511d
SHA512 d3705e123d0672ac5b97783b6e03c0e78447ebe7df9d01574543177af4d78d54f34005a320e46233ccd1ce6c81d2076f6fd63b9de8928b35b1c5f37e483bd5cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ff6825762b8fc38505a97f7f3c7d7c772765decaecaf6a4efe7c55e0396f4868
MD5 d4bf5c73384b96226e02a79e5b835af1
SHA1 4bfa78b5c3188b4d545312cd1132350cbef84b81
SHA512 0efce0b1fc92027adadf877d69e3b901dcae4c771429da20814e1278a5cb70315fa0a3e4801a88cf1c371894bda4a07bd76bb7e19e8989fa55fbcb9d320c35b7
MD5 SHA1 SHA512

Submit Download

svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACABCBCAABCACCBCCCBCAABACCCAACAABACBBCCCCBBBCBCCBCAA.exe
Size 5.4MB
SHA256 06f5bd30e09f34c7fa3c1c871abf118b0ad794dd0da9789fb0b6fdc0fabee021
MD5 b6ae5e47b3ed531e41c2ae7c2db0be23
SHA1 b5ea657b08e7dd905a9684f162bbf8d19b521a58
SHA512 87f4d038698fb24cc975608c88875ee43f8c7e7108c2f30bfe6829fe413d2f9ee102b5329b9771acc872f9336ccd07c6644fd3b81569fd7a0c05334f9d3eabab
SSDEEP 49152:U+ES+Ez8obnyMWGhO/+Ez8obnyMWT+ES+Ez8obnyMWGhO4iw21+ES+Ez8obnyMWx:frBOr/rBZrBOr/rBTp7B
TLSH
T189466C0E22FC00B5D8BF9175D6A58265C671B43127329ADFA290C73D9F6B9D1A83CF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 f650486e8e7b47c65402667b2711da1d6159f3262140c618649644836da908c9
MD5 b515c5628cde90e72fe77a4eac00ae81
SHA1 83e695d1a97f6abe063181624754fcb772431540
SHA512 592cc0d842e85dc9b9c8d62a341ed261061f7e2602128cd8e213bece0b0e5ece0c1cbd70868bd0c5f24adfbcdc6848f3e1cd4a3a61dd15a1babc77e1b6b15fc9
TLSH
T12D11EE60A4E5ECD7ED32A8CB531ADBC20CF867AB685C5A56130DC12C9F85C334D594E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-0-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/560-8-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/1744-37-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/2356-60-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/4660-87-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download