44931cee4208dd67037a6b56da28e37b7098ea81e7bcc209e3b1b080c41382a9

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
Size 2.4MB
Sample260814-evwfgafb64
SHA256 44931cee4208dd67037a6b56da28e37b7098ea81e7bcc209e3b1b080c41382a9
MD5 665786aefb8209fff90c478233030268
SHA1 fdaae41b7b1e268cc575140de5b3b0c9b7afc510
SHA512 83286ecb1c86b9db9e69ecfa59eb62d9b0d4a819c5103cad4f1ffac19c09ebc38bc3a9461abc73bf40fc2d1bd0641963818fb00b351a79d91f296118d0a093c8
SSDEEP 49152:U+EqTy6i1zuajsauZnh+EqTy6i1zuajsauZnGDd79WCF:Ttst8p7D
TLSH
T1F7B57C1D73E800A9E5B78539C6A68226D671B8312731D6DF2390C63D6F37AD0AD39F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
3924	svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe
1108	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBACBABBAAAACABBBBCBCABACABABCACBCABCBBCABBCCACCABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe"	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCBABAABAABACACABABABBBCACCCCCCBCACABBBBABBCACABBBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe"	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2056	sc.exe
3424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1648	cmd.exe
1940	cmd.exe
1776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
3924	svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe
3924	svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
Token: SeDebugPrivilege	5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
Token: SeDebugPrivilege	3924	svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1648	1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe	92
PID 1648 wrote to memory of 5644	1648	cmd.exe	94
PID 5468 wrote to memory of 5288	5468	svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe	95
PID 1772 wrote to memory of 1940	1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe	98
PID 1940 wrote to memory of 3424	1940	cmd.exe	100
PID 1772 wrote to memory of 1776	1772	2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe	101
PID 1776 wrote to memory of 2056	1776	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_665786aefb8209fff90c478233030268_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBBCABACBBCCAAABABABAABBCBBCCCACBBABCBBBABBCBBAAACBBBABBAAABCACACBBBAACBACCCBBABCCACCCBCCAACBBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBBCABACBBCCAAABABABAABBCBBCCCACBBABCBBBABBCBBAAACBBBABBAAABCACACBBBAACBACCCBBABCCACCCBCCAACBBABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe" start= auto displayName= "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe" start= auto displayName= "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBBBACCBBAACAABCACCABACBABABBCBBAAACBCBACACBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCCACCBCCCAAACCABAAABBABCABBCCCCCCBCAACBAAABAAABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
1⤵
- Executes dropped EXE
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab42a9f9cca1bee56b68575846505327eabb67386fe4e456074f29f835338009
MD5 1bdd390181f43ec90b62425e841e0aa0
SHA1 15ccabebc854cf80ebbc62d0fb07cd94e654f168
SHA512 d52eb07edaaa2d302c67ed8c3dd871704ecb7c74c9113e0e3c37fd6fa603949ac61fc67eec28cf39861011406554270f1b071eea44408056d3f158a893595248
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9b860b8c61a593fa7b4856248950232821cee379830a2777074d98ba56cadf2
MD5 424e1b91d4551083610e960f70fc3c5a
SHA1 dec9866868001848c2efa38b5f683500f4e7adde
SHA512 173192a8824fdbbf871dd263e74e641ba4d2ef3d1203fc22f22f3af0f640f1780d83243477961478325b6d05163ac1059c04fcdb88db945f930daa49daaa9298
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0f4f6d448651f762147494d1d462f30310481a5138b15ca4ea66749209c3cdd
MD5 d29e05cb911601addccfc224b5691777
SHA1 a487fa76be8e4accca9a83a5e6b96d0b914c6c5a
SHA512 7fb38dc1b3df55c774ef6cdf65491f7a536fed8aa6dcfe7907715be12c205d5b3655bcaff5c10f3b2ced8a7eb4fb7f7eaa17559f5e8dedfdfa7b2fb8685b71df
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68033a0f49796ad29e1e70ffd7284f7801b66799e733dc92d39cb1c9ea8dfbc8
MD5 d6b2faec22ce9cd2b1754cdde11d1b63
SHA1 f916869d70c10ece2776327fe0759b5d515a8c86
SHA512 950dc1719d11705ed2460ea717758c13dd36e466506e76a9fd101a0c72bb2dc031dea17d16b4017ee40d8b7200b4beed78a51e26584004be6d57923ef9ebd29b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58698a8234abe267ce93340c5a209a64df257ff30614c2226dd4607abec8222b
MD5 c3c68fcd47e1c75a9e012b3e0db94548
SHA1 e85cd1540e9d6f3d7fa46988c60252994acb43dc
SHA512 59d1a76e8d570af4877edf7dce336c70d898e59e198f03e6c6f1421fad799396e996704a7385bf014c48da6c55a297c2058ad581c25e63565ae3e3f7b6b112ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1e7f1a59e2099ca4451465a2938c76c691dc98714c5bb166d51e1a2ae29b9dcd
MD5 ec60fe0b325fc94ba42e7a6e6d8618b6
SHA1 5d12c7337e0e47af0b1f5bbd0b795620fe2f9c75
SHA512 e9547f486917f08f870d12dcb69ffda6d4ffdf62e502e20c262396c1a0f6ea69cd3ced4b69fe9966bc2111edb202cb3a615836610db7a4d8ae8289dc1e0b3335
MD5 SHA1 SHA512

Submit Download

svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBABABCAACABBCBACBBBBABCCACBAABBCCBABABBABCCAABBCCA.exe
Size 2.4MB
SHA256 44931cee4208dd67037a6b56da28e37b7098ea81e7bcc209e3b1b080c41382a9
MD5 665786aefb8209fff90c478233030268
SHA1 fdaae41b7b1e268cc575140de5b3b0c9b7afc510
SHA512 83286ecb1c86b9db9e69ecfa59eb62d9b0d4a819c5103cad4f1ffac19c09ebc38bc3a9461abc73bf40fc2d1bd0641963818fb00b351a79d91f296118d0a093c8
SSDEEP 49152:U+EqTy6i1zuajsauZnh+EqTy6i1zuajsauZnGDd79WCF:Ttst8p7D
TLSH
T1F7B57C1D73E800A9E5B78539C6A68226D671B8312731D6DF2390C63D6F37AD0AD39F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 51db63ebf17b34a94bf1a76ad9138428e8033764a06290a226db143961f08318
MD5 70b6a536261aae640b698de0a3eeaa40
SHA1 701a80fc99e1150d60edfcf72b3bfa53fa60c02b
SHA512 fde2e3676a36b11d8e744b6f484c357db3dea0c4c772a47e5a15c924cf6f01d2a3b7b3b728a941cc548cea6e435a0b4585c8af11318373aafa4b0de090ac9646
TLSH
T1AF110121E8E5D477EC33A88E912D9B031DB073AB68AC7A00534A5228ABD5D31CF514EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1108-81-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1772-0-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/1772-7-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3924-79-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/5468-34-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/5468-23-0x0000000000320000-0x0000000000341000-memory.dmp

Download