0da97b7b1ebc1aa1acf3314a534a05099bc2a5684d9c2c4e7219e31e9051a51d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
Size 2.3MB
Sample260814-e2d5rsvcjg
SHA256 0da97b7b1ebc1aa1acf3314a534a05099bc2a5684d9c2c4e7219e31e9051a51d
MD5 556295d7c49bbf9f38a694f09657e509
SHA1 5d95527a784139141174195f9ff30abf80670f84
SHA512 58aabd80c347e7e7ffca709f4eee473710a4e31927a898b4a0225e6f9a7c2265c800ae6fe5cc9c7005b5adada9349af97ca30766d4a944b29a8c51ac2f9f7c5e
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+EW5+ES+ES+ES+EWz+EELgVLKbDd79s:AKaKbp7S
TLSH
T149B57E05FA434071E96720B04DDFD3BF8974BA2187158DEBF74D8A2B6A32BD1643931A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
2816	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABABBCCCBCBBCBBBBABACCAAAACBBAACCACCCAAAACAABAAABACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe"	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5292	sc.exe
4488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3588	cmd.exe
3600	cmd.exe
4604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
Token: SeDebugPrivilege	3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 3600	5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe	91
PID 3600 wrote to memory of 4076	3600	cmd.exe	93
PID 3760 wrote to memory of 2384	3760	svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe	94
PID 5000 wrote to memory of 4604	5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe	95
PID 4604 wrote to memory of 5292	4604	cmd.exe	97
PID 5000 wrote to memory of 3588	5000	2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe	98
PID 3588 wrote to memory of 4488	3588	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_556295d7c49bbf9f38a694f09657e509_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBBCBCBBABBCCBAABABCAACABCBBBCBBABCCCACCCBAACACACCCCBAABBCBCBBCABBBAACABBABCBBAACCABCACABCBCAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBBCBCBBABBCCBAABABCAACABCBBBCBBABCCCACCCBAACACACCCCBAABBCBCBBCABBBAACABBABCBBAACCABCACABCBCAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe" start= auto displayName= "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe" start= auto displayName= "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCABBBBBACBCAACCCCACBACCBCCABBBCAABBACBCBCBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
1⤵
- Executes dropped EXE
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e78f4173430e7357221927160ac82aadf8227615125b1e0a74561209e02b52f
MD5 6f753ef4037083d09cb85e0d43f8a939
SHA1 dca319789015543adf00b7e6ef8cb411e40530a9
SHA512 2f4e66b56773916986cc1769a5b8cede49b86edca268821a40fd1dbb6cdde2338c688c7e4777f70da86f88400407dc438dc9ea0a233fbbb352fb823345198788
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dfebd7d5fac08c6cfcbeafbf58de3a4a4475c3b13c4196543c1079635573629
MD5 7a81468465a5dab6f2586cae8a4ad45b
SHA1 710ae51466b996a93838980f4f84c134ebdc0fd5
SHA512 50994ddb052f0db518caaa9cb8d577d9080d2144d52687918779acb52093ff1bd0366ce90757a1a5a484c80716bfe18ff3f21a36fa0ebb34806d7833cd16060c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f42bd0ce230a97d92ca578cb5bd79d2af255a2b94da69400ceff82e73d7cb4f0
MD5 5ecc8f0ab89236dd706f80624255b6ff
SHA1 85d3a9570552a6ab6414c374552ee6f050b82b26
SHA512 3a2140ca0fb4a5f717a0a07633d9a8cf59aeccf3ed3ee0ba9e5485adc3b520b8c4d8ef1b4e4e971ca4155c721f7755539aa939cfc66e678b8b79179dfb767536
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a30e254c065457280ac6ea7f940d6e35dabdf557619015b7a0a929f6271d64c
MD5 dcdb48d659513939e910677de1dd460d
SHA1 6f6a6fb3e09d70f9b1f2737f530062b5c7d6e379
SHA512 00509805d492e41e72b3388f49dd206508407396e2774f4e387f2364818a72d8dc25748c4f1315733f2c4ffd6e599b8aba4787999e18dfabb37b833b14babada
MD5 SHA1 SHA512

Submit Download

svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCAACBCCABBCCBCCAAABAABBABBACAACCCABACBBACACCBCBCCBA.exe
Size 2.3MB
SHA256 0da97b7b1ebc1aa1acf3314a534a05099bc2a5684d9c2c4e7219e31e9051a51d
MD5 556295d7c49bbf9f38a694f09657e509
SHA1 5d95527a784139141174195f9ff30abf80670f84
SHA512 58aabd80c347e7e7ffca709f4eee473710a4e31927a898b4a0225e6f9a7c2265c800ae6fe5cc9c7005b5adada9349af97ca30766d4a944b29a8c51ac2f9f7c5e
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWz+EELgVLKK+ES+EW5+ES+ES+ES+EWz+EELgVLKbDd79s:AKaKbp7S
TLSH
T149B57E05FA434071E96720B04DDFD3BF8974BA2187158DEBF74D8A2B6A32BD1643931A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3760-24-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/3760-37-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/5000-0-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5000-8-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download