c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Size 3.4MB
Sample260814-eblrxstyay
SHA256 c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f
MD5 94fbb309fbc68b55d00131d75f9e7d49
SHA1 9ce6ef6b1ab59fd6e8af2d5ff7a79d53b8c90b2a
SHA512 1c5f88666321890966d7d3a762a428c9520a75bbd4d4f539f14f8fbac7eb8cb2d8969fe70baf32f8830793b25b80a736f3f619b41cccfb621cedb0ac1cc6b081
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+EC:Rp7k
TLSH
T13EF56D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
4544	svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe
1884	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCCCCAACBAABCABABAACAAACAABCACBCBCCBCACCCACBCCCABBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe"	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBABBBBACACCCCACAABBCCAACACBBCCBCAACBABAAABBBCCCABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe"	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1432	sc.exe
3376	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
948	cmd.exe
2320	cmd.exe
4720	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
4544	svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe
4544	svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
Token: SeDebugPrivilege	3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
Token: SeDebugPrivilege	4544	svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2320	4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	99
PID 2320 wrote to memory of 868	2320	cmd.exe	101
PID 3524 wrote to memory of 684	3524	svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe	102
PID 684 wrote to memory of 2216	684	notepad.exe	103
PID 4600 wrote to memory of 4720	4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	107
PID 4720 wrote to memory of 1432	4720	cmd.exe	109
PID 4600 wrote to memory of 948	4600	2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe	110
PID 948 wrote to memory of 3376	948	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_94fbb309fbc68b55d00131d75f9e7d49_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBAABACCCCCABCCCCCACAABACCACBBCBAAAAABBBBCABABAAACACCCCBCAACABABCCBCAAAACABACBAAACCCBCAABCCBABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABACBBAABACCCCCABCCCCCACAABACCACBBCBAAAAABBBBCABABAAACACCCCBCAACABABCCBCAAAACABACBAAACCCBCAABCCBABCBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe" start= auto displayName= "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe" start= auto displayName= "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACAACABBBCABAABACCABCACACBAAAACBAACAACBABACBBCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBACCBAABBBBBBABBABCCCCACCAAAACBBAAACCBBCCBBCBBCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
1⤵
- Executes dropped EXE
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db0a1f0fc391cafef95e4b513cfbb6b26578665031bef16bfdfc9ae4a8b35f93
MD5 e806bb5666a7dd92d714c7b56a7d4d2f
SHA1 9f3149b810f39c2bc6362d3577c958426050e5d0
SHA512 548ef47f1ceead35f0f02eb9e3bf9938ef7364f2ddd325d349c1601ce1fc3dd62667b3169e42307ca94050e5b78c4d365e849bdfd459d5f94378fb6342266527
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d64cfeae2c8e97dd46fe7b9bb43c996163f5d9c83e9f215d401705cb9b29cf59
MD5 239dbdb865b22b3b4c67f6a60d90367d
SHA1 fa22e7e7a3a3f3205fe70e2cee2ee6681fbf00d8
SHA512 5772189c9b34f296697f622fa92b2511fa0f52ccaadc37c4203ef22630104b157837d4f02f1c99fbe701bad4c982d95082816ecc87c88c79cba98e573bf0faf8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0f8874d26f72668f329be41f470780e49e124c70883183bf7b6810e2b0d534a
MD5 4ece434d8a01c8b95dfac348e15b95b0
SHA1 b06067c8603936107de7432f4cec732ead70665e
SHA512 1db0afd456b4e879482907f140de41b052f3f9b2b4f246249572571fd63f362eab2621d8268153552821416d843b941f2ddad8272981fd716ca70b5703fcca25
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 970f4d51674b74ca400d4a2a609e17bf208f1fad6d946fb5b2bcf75303d6d025
MD5 aac4771bf817f2fd6166082282815d11
SHA1 05ba6102ef48523d9c2d98d6ad214632e47506b1
SHA512 9dcf9b09b550a779bccb19cccc34beb4253817d6f4b6cefe5bf9bda261620d3a6e27a291dde15ab9d045e8b61e270f585f93b12ef3be30050009b386dd26b7f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 99589612ab689734b3c41ef3a4671d0a558a035abbfaa18b43770baf94c49145
MD5 f561901e68c6b6feb432ffb5b11fa4bc
SHA1 68435a7eb5f0cb7917d960e2c62fb1ec7b6c6a8c
SHA512 8e3bc42a9391d994d52c44fdec4cfc2f77406d49ca173a61086ab031b55fcfc16c4864652574c25a3c2120b8f362ca35e9903c7da6fc18ef55d0f6a53c675b1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c963ef145e34a310926d45af2eba1fb31604270350762cce8667df959fee4cc4
MD5 16a5fcd5f71236e1472cfbf94409afaa
SHA1 72e8ba6bd2457c2ba13753c275ffb32f0ffac924
SHA512 07b016824bd390dc7c9a0c23e787c0276b10c7e3bc63df94f823ef59878264c8b3087e2c0a58417d00eaf80b15074ce2e314f6a3029f1d0bd67eb1576b73d308
MD5 SHA1 SHA512

Submit Download

svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCBCABBCBBBAACACBCACBAAAABCBBCBCACCAAAAACCBBCBCCCB.exe
Size 3.4MB
SHA256 c92e6d51d94d46496e192fea08b763b71f9212d71211888829aae41db60f6d7f
MD5 94fbb309fbc68b55d00131d75f9e7d49
SHA1 9ce6ef6b1ab59fd6e8af2d5ff7a79d53b8c90b2a
SHA512 1c5f88666321890966d7d3a762a428c9520a75bbd4d4f539f14f8fbac7eb8cb2d8969fe70baf32f8830793b25b80a736f3f619b41cccfb621cedb0ac1cc6b081
SSDEEP 49152:U+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+EC:Rp7k
TLSH
T13EF56D05F98350B1E97B50B04DDFD27F8631BA2186218DEFF78D862B6D23B906938716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 df1489af4bd54901967da33054a0773303c613ef522d1bd3756bd52f20eb58bf
MD5 8b1f5af2d9fb119fcae3d9e9fd0a43e4
SHA1 c1f73a051c7db3ce8d921fb7a3a34efed09610ed
SHA512 8e7a9f82d732914734e6805b6e57d3d11e39be50fbe49ecfdb76d41ecfbbcac6f438b7d22bfefa2ee82613212ec26d60586a66a7b0035e9e6cd3a996c1a62b93
TLSH
T16E119155E4E59C57F9337CCF432A9BD20CFC7A5BAC186A6522090228AB95C334E258E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/684-59-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/3524-27-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/3524-37-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/4544-78-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/4600-8-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4600-0-0x0000000000830000-0x0000000000851000-memory.dmp

Download