b0305b4e6ff50a655d2cb70b9d2b457ae23cba14facce4d130bf826a122a84d4

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
Size 1.5MB
Sample260815-ejapmayzb1
SHA256 b0305b4e6ff50a655d2cb70b9d2b457ae23cba14facce4d130bf826a122a84d4
MD5 50599c257ae9ea6015ac6d9718a2f571
SHA1 7158070fcf7ba372a13156a578aa0efa36ae189f
SHA512 9b22315709d9a72175ffab6d6e75d4ad383790d2068d2a3f0a438557b3c177ad736a68e5ebd978a84a1d83520656f46208f14e4cefc2929bd5f3eb582736eca0
SSDEEP 24576:m9+EM0q9+Eiya+zrYn5e9+EM0q9+Eiya+zrYn5WafDd70iTWC4:U+ES+EI+PY58+ES+EI+PY5xDd79WC4
TLSH
T19D654A28BBD55025F57395B089BBC2B57D30B9204B20C6EFB644B71D5E22BD0ED3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
4236	svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe
1728	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AACCACCCCACBBCBACBCCCCBACABABBBBCBCACBCCBCCBCAAAACBBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe"	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BAACBACCACBACCACABCCBCCCBABBBCCABABAACCBBCBBBACCCACBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe"	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4552	sc.exe
4276	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3288	cmd.exe
3940	cmd.exe
2184	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
4236	svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe
4236	svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
Token: SeDebugPrivilege	4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
Token: SeDebugPrivilege	4236	svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3028	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3288	4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe	99
PID 3288 wrote to memory of 1140	3288	cmd.exe	101
PID 4444 wrote to memory of 3284	4444	svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe	102
PID 3284 wrote to memory of 3208	3284	notepad.exe	103
PID 4064 wrote to memory of 3940	4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe	107
PID 3940 wrote to memory of 4552	3940	cmd.exe	109
PID 4064 wrote to memory of 2184	4064	2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe	110
PID 2184 wrote to memory of 4276	2184	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_50599c257ae9ea6015ac6d9718a2f571_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCBCCBCBABBBBCCCCAACBBABACACBCACAABACBACBCCBCBCABACBCCACBABABAACABAABAABACACBABBCBBCBCBBCBCCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCABBBCBCCBCBABBBBCCCCAACBBABACACBCACAABACBACBCCBCBCABACBCCACBABABAACABAABAABACACBABBCBBCBCBBCBCCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe" start= auto displayName= "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe" start= auto displayName= "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACAABCBCBBABBAACCABCCACCAAABABACABACAAABCCBCBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCABBBBCAAACAACBCAACCABCBCACCCABBBABCBACBBBCCABCACABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
1⤵
- Executes dropped EXE
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c17f7a9bdc946baaa8779f6d7f9e997fb084ac375d0d12bdb1c412465e43f3f4
MD5 161285d2d7c1bfe6a00027c18ce6957a
SHA1 22fba9e2e38134dd134c3caa2ed873c77e5fbb8f
SHA512 08e42d3cb0d79c0d8854577be6175f6325b4520e75b2ea3fde93f924a9843b5ba4aed60099da7cc0a0be7773328ec3963ed956c53a8c01a73c8caa43b545e1c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 962560249e423d63e1d9d61d1b79eaaa839421b4301420221c64b7a8555141b0
MD5 dff87befd534d12b9c0d9bae296c61cb
SHA1 d5c055fc632dbbab5de1272d72f48d6592b597ff
SHA512 326966083a6e8d94c34825e5de53e673d3d27eb8b51e5292b04a6340c97c4ec79129e337ec2017cdca86d53821d37a7f110d13fb397dd26a6ca9aef134965302
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19c51a8ab80aa883a2b4335fc0cd2621161593acce1d1e93ea2d2ac48c745156
MD5 6ccfce75341fe0407cbc24891bec50c7
SHA1 55e3eb59376489eb76983ffa5bf6cae3682a1358
SHA512 eb436165bb5368b382697b31f56e061746e0b379debdec57ba64c33312583e62853019d0743a206341462698baeeaf863e25dad19d0f094d4ba6720849b7a7be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 209a358334d50caa5bb7cbd8742282640910d1b8793d8b1cc99f0ca93edacccc
MD5 fa40b9cd810987a1983c4f30adeef742
SHA1 b031fde725b3eed01e95e78b7039afa464cfc35b
SHA512 b6bde481e2f6a1bfbfb4d13892902b53999f8a7282d9ecec267e96aa749c45e73b281cf8db2f5d7e9de4a0e7116465e4d6d93001be25f386025d52c6d9bd9442
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7d2fa6c90ac5c25df0ea43fc0ffda093961912a1b21af38e6cd451dfc0bb7539
MD5 06df41cef54f8b7d0b7059883d0b101e
SHA1 c01811043b202d467f353c42ff0fe1256c4c0e0e
SHA512 4bbc29403a71a3745accbfca58c8355d2e73ad07beb6b5f806e9317505791a270545a98fd77f46c69bd6888d1384876cc4402adead5620f89ee2a01ffc0e839a
MD5 SHA1 SHA512

Submit Download

svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCACCACCCCBBBBACCBCCBBCBACBCAACAAAABCACBACBBABBCBAC.exe
Size 1.5MB
SHA256 b0305b4e6ff50a655d2cb70b9d2b457ae23cba14facce4d130bf826a122a84d4
MD5 50599c257ae9ea6015ac6d9718a2f571
SHA1 7158070fcf7ba372a13156a578aa0efa36ae189f
SHA512 9b22315709d9a72175ffab6d6e75d4ad383790d2068d2a3f0a438557b3c177ad736a68e5ebd978a84a1d83520656f46208f14e4cefc2929bd5f3eb582736eca0
SSDEEP 24576:m9+EM0q9+Eiya+zrYn5e9+EM0q9+Eiya+zrYn5WafDd70iTWC4:U+ES+EI+PY58+ES+EI+PY5xDd79WC4
TLSH
T19D654A28BBD55025F57395B089BBC2B57D30B9204B20C6EFB644B71D5E22BD0ED3A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a4aa3e438fe91c793f5ba786e76e54e28cce6d615a964882853a2077327f17c5
MD5 8262c01334fea4dc7e228c4b903b0b8a
SHA1 63b06c3d9f0715cf1553c60c0e996be8208e3c9b
SHA512 5191993a0378e7fa0dfc9b014967baec5939b4e608e1aa4b6c6f59685183a9b1512a19759d9970e3f9f962efac235b4b593bbad19cb106942b37689275bc1614
TLSH
T17411EBA1F4E5D8A3F932798E1A2ECB9318F47B9F6C9C5E65234882197745C338D190D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-89-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/3284-60-0x0000000002C50000-0x0000000002C51000-memory.dmp

Download

memory/4064-7-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/4064-0-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/4236-87-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/4444-26-0x0000000000120000-0x0000000000141000-memory.dmp

Download

memory/4444-36-0x0000000000120000-0x0000000000141000-memory.dmp

Download