fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Size 5.3MB
Sample260815-ea5teaybkb
SHA256 fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac
MD5 65d529ae0093de9f42d0cdc0c7720342
SHA1 dbdd46da82a5f8a33628334ae28604d09b8472ba
SHA512 8f2e9fd27864a8b107f8dc729f94fec7f7516aaff94fd6372b531428bde8fa433c55f79418df907ae5a310279fc9093ca018878f733f75f3f5e285ecf9227823
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2A:Bp71
TLSH
T1C4463B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2080	svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCBBACCACABAAAABCABBCCABABCCBBACCBCAACCBCBBBBAABBCCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe"	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1040	sc.exe
2280	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5480	cmd.exe
5948	cmd.exe
3564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
2080	svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
2080	svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
Token: SeDebugPrivilege	2080	svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5480	3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe	92
PID 5480 wrote to memory of 3020	5480	cmd.exe	94
PID 3008 wrote to memory of 5948	3008	2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe	95
PID 5948 wrote to memory of 1040	5948	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_65d529ae0093de9f42d0cdc0c7720342_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACBACACAAAABAABCBBBCBBCACBBCCAAAACCBCBCBBCAACCBABBCCAABBCABBCAABACBBBCBBABBCBCACCBCABBBCBCABBABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCAACBACACAAAABAABCBBBCBBCACBBCCAAAACCBCBCBBCAACCBABBCCAABBCABBCAABACBBBCBBABBCBCACCBCABBBCBCABBABACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe" start= auto displayName= "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5948
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe" start= auto displayName= "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA"
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBBCBCCBABAAABCAAABCBCCABCABCACCBACAABABCABBBABA"
    3⤵
    - Launches sc.exe
    PID:2280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2080
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c3fe9431fa5102143b89ced15466316667f37d62808a67b0e9fa702cdd890835
MD5 2a73c3bfcc10dc240a90574207933f42
SHA1 29dbc90565165742df4483d675055dc3cd3485de
SHA512 922e8adf190586d2f3ebf08ebdcd3225e3b10e42e0bc809ce1255bfb7b78d3e51f8487d58350c97e3d3c9d50e3a452d9e3b800082947b41265593c2905f0a560
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 68f217aaacf36c77caf174037042862c477600aa6adfadced074d3e72a8dce2c
MD5 c7f728010208072bcf25a5ecd06c09b1
SHA1 2e8d87532652cb08da05e0ca12d6e250f30c287a
SHA512 8486407188a061c3587d285e9a7486fa03c6dc61a42c49b87e884825fa21a75a8dfc13b4d5dc318f0c8cccb9d3ed2a4a9e36f3091df567d293f9b0cdd2cbe82b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4adfc1222be5d3c1fb0f0900b903483139868e407e2fa207d9e9e2f4749652f
MD5 b6375cb2b9baad17ef6004439c0a68bb
SHA1 b793ee98279e95272b3d5172330e746f27625162
SHA512 21a546defb9211576e2049195f94249615b0b2bc76043ebe812e9900728e54f8b9d5c15b14fda237d64ebd99efd06ed7cd582ffd4e8b3bc45b5af1f153eefddc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d809e46bdb56da8f275103cae35682825f52b91320d538cc6ba73560f550d3a4
MD5 6da7b19d809c9652782311b3432535b6
SHA1 307b60812553a5fff2ea5487fd31b1dcd616845a
SHA512 cd345dd223fc8915f4aca1513de751ff763c06e47dcc27b33b2bbd98ea254799afd8a2baa22e034f0498e13a3646c9a68f2f52af83ed028aa4d2b8242563add4
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 16.7MB
SHA256 70a2e4297118e207a1d9102f8a6a645072a5ffb0a6b5724b718320b27260b7b8
MD5 4e5ae9edf4242b7729ae900715515fa5
SHA1 48653ec01b86b54edb73f9f70eb638ae5881e586
SHA512 4044cfa91fa03718fc27fb87a3242c615da7d0479ff8c04e274660676abe93227c352d3727a8bfd5dd58ea98155257b3ed690167056feb7e16ff9139129beaa4
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2c:Bp7Dp7Dp7PYwUyPzJyjmJBgqVjt
TLSH
T1B9074C0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 3.1MB
SHA256 ed238308731a7d3d61976059f875ce415012cedb352deda98299eb249fdaea7e
MD5 5f1f8d27b7526c32966e36f2fcdb1153
SHA1 ee533bbf707c57b2aa5117783a945c840677a2ed
SHA512 88515af8ffee688e9b69259e9bbdf177e1698f8c31d2bc4045d5e259935ea7de67dec30c68246eb4d2c1890e899ebaabd82c5d32402880b7d9702dd267fa837f
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EP3:F
TLSH
T139E53B0977ED4854F5B7B13489B68669DAB2B8915B31C7CF9280833D0E73BE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 37.8MB
SHA256 b3f0d9e1c64194ba575d35bf8d0551d33b02b373dc4ba56818599030d4f7d878
MD5 767e6cc97e7e2d026c0cf15dab9715bb
SHA1 d5730981f1189ae0db7135e665614fc508c735c9
SHA512 d890d2276ca2d3edf7fa4828981a8c6b627f691508069de11125131e49215fb9bd575c6db1b8f5ddafcd6cd6d45cf65958b5c60327c85a9bfcbd55e6d428b7b1
SSDEEP 98304:Bp7Dp7Dp7Dp7Dp7Dp7Dp7PYwUyPzJyjmJBgqVjq:HBBBBBBPCqzi8OqI
TLSH
T1AA974C0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 384KB
SHA256 4696444ece7291a8df56034a80550fb20ba53a50f42520e1b5d73b17d512866d
MD5 a494cfbc0ad7ed38a88218952df101bd
SHA1 2ab79d663022d438f7ba62d2d4a164f080babdbb
SHA512 19954b9392d19552ecc68343b3591c236f7001957c2b0b0ea539d0f718d1653389e29c16b7ddb488c4a5c598dec73f90afda119cd5abe04f687b853de2cde1f8
SSDEEP 6144:m+dTTUFgEs3XojAdF0VPUgjnRtnNlW4+WD8TbVC2arT:mgUFgEsnojAMTjkWIw2y
TLSH
T15D842B0977ED0854F5F7B23489B68669DAB2B8515B32C7DF5280833D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 18.4MB
SHA256 f17afa72c6fd6662668ef0813ccbcde71aa7ac38703b85e15c858e1eca518832
MD5 b2b74e37f5067134197a1fa73d97702c
SHA1 69b91a50788541dc09917aecc84f79fa4e972423
SHA512 a54779d0ac190df9f673e640734d08550595aed43bdf51321d120330e3844138e16cb558cbcd66c41ae644caa0a3a8390157df03dfb31d0012adb9546eaa4d0b
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw24:Bp7Dp7Dp7v
TLSH
T197173B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABBCCAABCAAAAACACBBACBAABABBCBACBCBCCCBBAABCBBCACCAB.exe
Size 5.3MB
SHA256 fe539fed886eabfc8a90f04e76badbbc890c440236072880bf81bf05dd5628ac
MD5 65d529ae0093de9f42d0cdc0c7720342
SHA1 dbdd46da82a5f8a33628334ae28604d09b8472ba
SHA512 8f2e9fd27864a8b107f8dc729f94fec7f7516aaff94fd6372b531428bde8fa433c55f79418df907ae5a310279fc9093ca018878f733f75f3f5e285ecf9227823
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2k+EPiw2/+EPiw2k+EPiw2k+EPiw2A:Bp71
TLSH
T1C4463B0977ED4824F5B7B13489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2080-53-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2080-34-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/2080-73-0x00000000001A0000-0x00000000001C1000-memory.dmp

Download

memory/3008-35-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3008-60-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3008-0-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3008-23-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/3008-12-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download