fb87c3f9dbe9ae12e375cb0cfb9c4679e314356b49d81915fa63429a712918cf

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
Size 7.4MB
Sample260815-b2srdaxta1
SHA256 fb87c3f9dbe9ae12e375cb0cfb9c4679e314356b49d81915fa63429a712918cf
MD5 33320bf19176fa55bc3211533fd5a10f
SHA1 7b04c5389f4f9417028622cad667729409b57170
SHA512 c61c67feb6641ba863a1583ad14e53ec99d0949166a759fa64e5b0811a3c7e69e60bb2da9145d613b032bce815f8cc760ae1f435c4e7cde287a5be16c3f7e805
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddjP+Ez8obnyMWmddj6+Ez8obnyMWmddjP+Eu:irCrRrCrRrCrerCrRrCrRrCrFp7J
TLSH
T192763A1F22BC00B6D96ED179D2D28156D6B0B03127222AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
2732	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
528	svchost_BBABABBBBBABBACCACAABABAABBAAABCBACCBBACBCACBCCCCABAABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCAAABABCABCBCBABCCABABCACCBCAACBCACACBACBBBCACCCCABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe"	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBBBAABABCBBCBCCBACCACBCABCBCBAACAACCACCAACBCABBABBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABABBBBBABBACCACAABABAABBAAABCBACCBBACBCACBCCCCABAABA.exe"	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4956	sc.exe
1340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1516	cmd.exe
2388	cmd.exe
1352	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABABBBBBABBACCACAABABAABBAAABCBACCBBACBCACBCCCCABAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4632	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
Token: SeDebugPrivilege	3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 2388	5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe	92
PID 2388 wrote to memory of 4632	2388	cmd.exe	94
PID 5988 wrote to memory of 1352	5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe	95
PID 1352 wrote to memory of 4956	1352	cmd.exe	97
PID 5988 wrote to memory of 1516	5988	2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe	98
PID 1516 wrote to memory of 1340	1516	cmd.exe	100
PID 3252 wrote to memory of 4120	3252	svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_33320bf19176fa55bc3211533fd5a10f_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBBABACAACBCBAAABBCCBCBACAAABCCBBCABBBABBCBAACACCACBCBBBCAAAACBBCABAABBBBAAACACCCBABABBCAAACABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABABBBABACAACBCBAAABBCCBCBACAAABCCBBCABBBABBCBAACACCACBCBBBCAAAACBBCABAABBBBAAACACCCBABABBCAAACABACBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe" start= auto displayName= "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe" start= auto displayName= "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBABAABABBBAAABAACABBCBBBCABBBACAABACABCBBBCBCAACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABBBBBABBACCACAABABAABBAAABCBACCBBACBCACBCCCCABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABABBBBBABBACCACAABABAABBAAABCBACCBBACBCACBCCCCABAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 816739de719f8b8fb9285541066c2ec7d763d21e61ebae5f65747ddfe10d2061
MD5 6c9c398b214e355b6472cef049902ace
SHA1 6012a184ea4f9cc18034d6b6ebc2e0736f35bb2e
SHA512 239cd1ff9abb466c2fff592fc5d8bdc8402967926e4e584afcd6b27a8b9cc004ea389dc942e298e24cf1cd4133e05d98ec7f84fcda6c933a540faa09893e42e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f214872de1924168994f025d91fe693a7f8702fa6df8055e63c3938aff610055
MD5 390a403b8dfb6254ebe29bf51267235e
SHA1 1c7f4565afc710a81d618cd4cc3808444fb69369
SHA512 88918411e515355ea6561a6d92b890a06297114f8738d5432103e687ae08bbe200e8662984270eeaf481f1862f44b7202905261896b42a1dd3ec5e5708acd3d6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e5e1b0e247a46a8fac9f04a0d671218c2d1a4ab26b861572ca83362c4834caa9
MD5 767a55a1bb7c082ece7d31acc658f293
SHA1 5593aecf980dd39bc87886e39e09a91045782b6f
SHA512 14c43e157a657963304d8fda95ad85c916f367f4c64bb4b9b711fbf11432e34447495748ed24040acc9dd44987fff43ff1c0d7760c8841c4ee7ed2db28b90534
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0850b6ebff409357a9b856def79b6e825c213cfcc0d48ef151b7b31a2dda79c0
MD5 b8df12a8c70b4a06343f82cdab77baaa
SHA1 b3b72e73f53dea030b91c513ede638105ba6d4d4
SHA512 b4085ebf1c38e27bcbaa40513af8a24d7df2f9bcff9a57baa6531152aee68ead191ac8d6616411b268144df9b3f7f955cd1754e3bcce763a6277103ad564d81e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7bc2f4265ec0af2e80dc0842c783ff008add93ccb842b6f7c7bfebe1a2bfa95f
MD5 7f0e806a0973ab1986e46154c4696d41
SHA1 dd1a9e8d0be4099f67dffa011229b8a4f69b20de
SHA512 901176e0589b3a702bfaaba130093246078589acb7a199eb5c525500da594c6cba22bda4d85a926aeb52fb1ec366e12fd870089fbe49b0c63b2e65822c7ddc65
MD5 SHA1 SHA512

Submit Download

RepairRedo.exe

Path C:\Users\Admin\Downloads\RepairRedo.exe
Size 22.7MB
SHA256 fafa08cc7f34f5d5fbff67d8cfab69ef323ba08f10ca8ebcd0780523165545b7
MD5 f8df0534548ab269f6c0f57df169630b
SHA1 94fcf0c2f2ea0fe7579076583dc01384eefefaf0
SHA512 686aeab953bf965c5092f04a178ddbc081cdf9fefab5ac2a42af880fd2e1da24f246c0397011377795e7c12011d4500ef4c0d569654186b6d4bc9510cb11a444
SSDEEP 98304:irCrRrCrRrCrerCrRrCrRrCrFp7QrCrRrCrRrCrerCrRrCrRrCrFp7QrCrRrCrR0:fFFUiDD
TLSH
T1FD374B1F22BC00B6D96ED179D2D28156D6B0B03127222AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairRedo.exe

Path C:\Users\Admin\Downloads\RepairRedo.exe
Size 44.8MB
SHA256 c2db879e9fc8ad0ca7ce5c2514c1c49963a70454f44bdbac7dd7b9c904c6019a
MD5 5668ce6cad5ec160f8079524880b82f8
SHA1 52587d53fc08c8780442ce67757e245db41a55ba
SHA512 6d0ef7c1637fd7c387cc52a92c84aa271b7f4948864254ff17d9c4cc1b3ef2a7997c18e076c782e6e4f76f2860a13a87402f46965ba374b26df111bdaa065ad7
SSDEEP 98304:irCrRrCrRrCrerCrRrCrRrCrFp7QrCrRrCrRrCrerCrRrCrRrCrFp7QrCrRrCrRo:fFFFFFUiD/
TLSH
T16EA73B1F22BC00B6D96ED179D2D28156D6B0B03127222AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairRedo.exe

Path C:\Users\Admin\Downloads\RepairRedo.exe
Size 1.5MB
SHA256 035b498738ada61f5223e4eb37fa1a60cddcecb20c7f70c858f5ef46ff620c14
MD5 c3c747f83b9b5c5ceff9675e3b4741bc
SHA1 7a5a55a27a6101bb9cc6bad488af540225c23e42
SHA512 016b11883c73280014bb83a04c13c7ad072749aabb9fef720e8c5010fb85bc19af4c0ed962db0ff27f2bd3e4057305ca59ea7df21d989cac70ee63e132ec2ce5
SSDEEP 24576:m9+EM0h8zA9biKyRq9WmddjY9+EM0h8zA9biKyRq9WmddjF9+EM0h8zA9u:U+Ez8obnyMWmddj6+Ez8obnyMWmddjPm
TLSH
T12E752B1F26FC00B6C96ED17AD2D18156D6B0B03127222AEBA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBAACCBCBAACCCCABCBCCBCAAAABCBBAABCBACACCAABAAAACBBCB.exe
Size 7.4MB
SHA256 fb87c3f9dbe9ae12e375cb0cfb9c4679e314356b49d81915fa63429a712918cf
MD5 33320bf19176fa55bc3211533fd5a10f
SHA1 7b04c5389f4f9417028622cad667729409b57170
SHA512 c61c67feb6641ba863a1583ad14e53ec99d0949166a759fa64e5b0811a3c7e69e60bb2da9145d613b032bce815f8cc760ae1f435c4e7cde287a5be16c3f7e805
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddjP+Ez8obnyMWmddj6+Ez8obnyMWmddjP+Eu:irCrRrCrRrCrerCrRrCrRrCrFp7J
TLSH
T192763A1F22BC00B6D96ED179D2D28156D6B0B03127222AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2732-88-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3252-51-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3252-33-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3252-72-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/5988-34-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5988-60-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5988-0-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5988-22-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5988-85-0x0000000000510000-0x0000000000531000-memory.dmp

Download

memory/5988-11-0x0000000000510000-0x0000000000531000-memory.dmp

Download