b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Size 7.6MB
Sample260815-ecckmsdf86
SHA256 b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d
MD5 62f1e6112aed596a20b90fd3da65a1f8
SHA1 d1d7e3975feccda16369c3a4972037e0269b6f9f
SHA512 7819343b7cb580b70861563a3a5c0b7d5bf3a4283759d1efeadc6865119efd91d06d26bf387e35cb84e73561a6f87f37c76fa5ef00f41a0a990cfed57878bb38
SSDEEP 98304:rW1PsiW1PsAW1PsiW1PsZ5aW1PsiW1PsAW1PsiW1PsZ5op7S:6xsnxsJxsnxsZ5fxsnxsJxsnxsZ5eS
TLSH
T19F866E05FA8304B1E97725B04DEBD3BF4D747B2187218EEFE749861B6932B919838316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
5040	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
4052	svchost_BBAABBCCCBCBBCBBAABCBBBBBBBBBBBABBCCBCCACCBCBCCBBCBAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBBCBBBACBCCCCACCCABAACCABCBACABACBBBCCBBBCACCCCABBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe"	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAAAABCBCACACBCACCCCABCCACAAACACBBAABABAACCCCBACCABCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAABBCCCBCBBCBBAABCBBBBBBBBBBBABBCCBCCACCBCBCCBBCBAAAC.exe"	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2128	sc.exe
4076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2460	cmd.exe
4204	cmd.exe
2620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAABBCCCBCBBCBBAABCBBBBBBBBBBBABBCCBCCACCBCBCCBBCBAAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
Token: SeDebugPrivilege	2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4072	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2460	1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	96
PID 2460 wrote to memory of 4032	2460	cmd.exe	98
PID 1788 wrote to memory of 4204	1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	99
PID 4204 wrote to memory of 2128	4204	cmd.exe	101
PID 1788 wrote to memory of 2620	1788	2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe	102
PID 2620 wrote to memory of 4076	2620	cmd.exe	104
PID 2064 wrote to memory of 3364	2064	svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe	106
PID 3364 wrote to memory of 2136	3364	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_62f1e6112aed596a20b90fd3da65a1f8_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCCBCBBCAACBBCACBBABACCCBABAABCAACCBAAAAABBBCBABBBBCCBACABBABBBCBBBCBAAACBBBCBAABABABABAAABCBACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBCCCBCBBCAACBBCACBBABACCCBABAABCAACCBAAAAABBBCBABBBBCCBACABBABBBCBBBCBAAACBBBCBAABABABABAAABCBACCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe" start= auto displayName= "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe" start= auto displayName= "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACBBAACBBBAACACCBABAABBCBABACABCAAAACACAABABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBCCCBCBBCBBAABCBBBBBBBBBBBABBCCBCCACCBCBCCBBCBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAABBCCCBCBBCBBAABCBBBBBBBBBBBABBCCBCCACCBCBCCBBCBAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5f3a3860cfd5140c82ad42dbd424c78eae1038122c38e011126727e5c18d5974
MD5 6211479b1db78c499dc9b728af6da8cb
SHA1 42e41382a52667ea775c8ce481820afe0b1878fb
SHA512 a4698dccc2e8d425b92fe3cc2ccb5f1d10e898a2161e9272bda3dc3128ab9f9557ffd027a4f3892bc8f4ba95de6c30d01f51c9e62bd6ddd85752aaa8a14c3ad2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47c52727637d89906e4f31a2df86cb7d2c8441166672c6c02ab5c9352d51a2fd
MD5 2f1b41cfeefadd9a4a90063cfe33dc6b
SHA1 a6acfdeb56062dfa8bf3fb48eeb34eb1c34d9bc4
SHA512 3cf981e53d8f2e048fb95c89e9ca6695a329807682f79c09acdcb0565bea47532374173a2533f9935c6d88f9f2a8a504eafec2406fb21fd2231bfa77b247da57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64321979804aebf8b6ad2922e8e552b3cb83440a67585d5f689ff76c57325e93
MD5 9d5aef1b0382e8b54144adfa57255b28
SHA1 86b4f2a3d4ee7f729e5a558d166e9183cdc81e70
SHA512 307e1b45b41a5ed2b919a62d1b19d88a375a6741305a791627b269eb086cb780f52c6ed32cf377fefbce10f33d9f035d318daac46caabde34533d3b4e13979a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c2ea8700eccb71538182a8b7102d3c585f49c9dc544adf8d19be544e3e13fc7
MD5 aafd806e22182b00999f7e8ba0beec46
SHA1 3b3b3f6bf44ef12e0dcf7324c9f89406f8eeecac
SHA512 18614d8d6fe607918dffdcdf1bad0025dfb9631b5c495ecdd6cc424ca4b04c8120308a816d037496e3fb81bcc6c9f71a9523b99d061e1fe043e8d6110e2e1676
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1418308e8072edbbe031e134ff7068c7aaa3c5905e136261c6f257d6d07aa618
MD5 6a6385a9f0b1513baf25787dbc633232
SHA1 436aa30aa13cd94479370937b50ca3439bdc9d9d
SHA512 d4f55584752c83822506eb28b505bb3830fb04fb3b268782510f96e24f7ea97c319a469b7788f7ba154e8a947a0f337cba5c0969c122d0cb717d51dcb0e77700
MD5 SHA1 SHA512

Submit Download

svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACCBCCBABBBACBBCBBAABCBBACABCAAACBABABACCACBCACABB.exe
Size 7.6MB
SHA256 b704b329d7ca2b491846e0447518ce6642184d0fbc923f1b658cb616edb5176d
MD5 62f1e6112aed596a20b90fd3da65a1f8
SHA1 d1d7e3975feccda16369c3a4972037e0269b6f9f
SHA512 7819343b7cb580b70861563a3a5c0b7d5bf3a4283759d1efeadc6865119efd91d06d26bf387e35cb84e73561a6f87f37c76fa5ef00f41a0a990cfed57878bb38
SSDEEP 98304:rW1PsiW1PsAW1PsiW1PsZ5aW1PsiW1PsAW1PsiW1PsZ5op7S:6xsnxsJxsnxsZ5fxsnxsJxsnxsZ5eS
TLSH
T19F866E05FA8304B1E97725B04DEBD3BF4D747B2187218EEFE749861B6932B919838316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-6-0x0000000000620000-0x0000000000641000-memory.dmp

Download

memory/2064-25-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/2064-38-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/3364-67-0x0000000005770000-0x0000000005771000-memory.dmp

Download

memory/4052-79-0x0000000000C90000-0x0000000000CB1000-memory.dmp

Download

memory/5040-73-0x0000000000120000-0x0000000000141000-memory.dmp

Download