723a04c73fb2708ca1873bd433536c7adb79bb9ef5ef4101cb9ea176ee878df6

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
Size 8.3MB
Sample260815-ep7asaydle
SHA256 723a04c73fb2708ca1873bd433536c7adb79bb9ef5ef4101cb9ea176ee878df6
MD5 402943438ca64823744d8d00f074c711
SHA1 4b8d9214de8c42709cc5d4b843bee23dbf8650e0
SHA512 a87fa87decd861df0cb35dbd494cc8c8b8543b3c92e960456e8fd899948659ae6f47d4cf8fef0fe30230bec30f66e6f006f78edc3d2ecf150332195fa80dfaaa
SSDEEP 49152:U+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpy:Zp74
TLSH
T1FE966D06FA8344B1E96711B10CDFD2BE8566B6318B228DEBE74D871FAA32FD15834315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
1156	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
3308	svchost_CCCAABCAAABBBBCABCAAACBCABAABBAACCCACCCCCBACBABCBBBCAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACABBCCACBBAACABACAAACCACABCACACCBCCCCAABBBAABBCBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe"	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACBCBBBBBCAAAAABBACBCABAACAAAABAACAABACBCBCCAACAACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAABCAAABBBBCABCAAACBCABAABBAACCCACCCCCBACBABCBBBCAAB.exe"	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4292	sc.exe
4868	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
708	cmd.exe
680	cmd.exe
5108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAABCAAABBBBCABCAAACBCABAABBAACCCACCCCCBACBABCBBBCAAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
Token: SeDebugPrivilege	3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 708	3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe	92
PID 708 wrote to memory of 5660	708	cmd.exe	94
PID 3724 wrote to memory of 2376	3724	svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe	95
PID 3360 wrote to memory of 680	3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe	96
PID 680 wrote to memory of 4292	680	cmd.exe	98
PID 3360 wrote to memory of 5108	3360	2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe	99
PID 5108 wrote to memory of 4868	5108	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_402943438ca64823744d8d00f074c711_amadey_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCAACCCCAAAACBACCACBBCBCCACCBABCCCBABCBCAAACCCCBCACCAAABCAABAABACACCBBACBBCAABBCBCBAAACBCCCCCBABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCCAACCCCAAAACBACCACBBCBCCACCBABCCCBABCBCAAACCCCBCACCAAABCAABAABACACCBBACBBCAABBCBCBAAACBCCCCCBABABBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe" start= auto displayName= "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe" start= auto displayName= "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACACAABAABBAABCBCACBACABBBCBCBBBBBACACCBAAAAACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
1⤵
- Executes dropped EXE
PID:1156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCAAABBBBCABCAAACBCABAABBAACCCACCCCCBACBABCBBBCAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAABCAAABBBBCABCAAACBCABAABBAACCCACCCCCBACBABCBBBCAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8cf61d27a673170d146de53afc2c9967e94bd12698ae73fc5f9619d10ed6d074
MD5 dc1e0a44d9b7112a16d8bdb073820c19
SHA1 2cdc66d8c2ea4c97447aec4c281f9860a2967c90
SHA512 8bcb3cd322ee36bd6c4f8040bc4cf71cd5baa59a06365ba9fd157569889314fa243d34af6142a39c4bd8627448a9c295d607c5683f2cb03fa0ebf48c4f32d4ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab58627bfad9384e58b78f3056083eadbd02f0fd6d0dc5c9e12e06c515d31eb5
MD5 9f03e953e4f5066a40769882f02962a1
SHA1 8f0f8921102644720d5f91902fb15e1848fcb9c5
SHA512 edfb4c5cfaf6a01171c3307898ea647303d525a12d0c2ad5431504af235bea0559c4c1adabc38caea06c22b05762c7dd192b1720ee7a7b8cce3de70f1f507092
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c7367f10ad0c28c7c8addf454606623a1be577cb93a31db8cdd2eff9bf60119
MD5 b35abc14f49569f807b40c2e03a8e93e
SHA1 4456897fe039785a15c38f48d76696767897d045
SHA512 090a3cb36881a0ac5ba815f837adab7ead05046f1d5996e3ebcef7b64eb685868752648305f4cd351c406c5020aecfca16a44d4df17a07917f5e0b4caee4b951
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc6dde3e32f3d59dfb90cc2bc8639903f4c73277f4bf6675516401160d61125c
MD5 fdecc3ccf04fc3931f7bd92b04f10b7f
SHA1 d0d7245d4661a16b9c92e7bf114645bb3d5828d3
SHA512 8b5aa130f2cd8bd0423a493352d5e0d90eaa6090958541ce301fc20a2eda54ce4c5761a03211fa795d10e06af37216d0a702c27b645bcf79d689bbd51a260523
MD5 SHA1 SHA512

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 25.8MB
SHA256 a31ae961c0b52ff7620512acab7047f5d57390ce6487d02794d0b71566aab316
MD5 ee153780163292c5ca2574509009ae42
SHA1 f44fd60a5a2735224374c0694d8af2fcce46d2be
SHA512 6bd76d40afb45c366d3cbd53c56d44e0eeef0b1a0b1f01a39639a63e0f4721b62ff398b998438babed41a78170642c1f1767377b429d6136f650a004f5ef6d60
SSDEEP 49152:U+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpk:Zp7cp7cp7DUHzg3SKg
TLSH
T13A476D06FA8344B1E96711B10CDFD2BE8566B6318B228DEBE74D871FAA32FD15834315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeUnpublish.exe

Path C:\Users\Admin\Downloads\OptimizeUnpublish.exe
Size 50.6MB
SHA256 693524d662ef6e96a3e8646669d3700dfbe7fabdbbf6ea4a8e76a8915b8efa83
MD5 f7c169310f4e6606893b8912f730c397
SHA1 2cd5c628b5e8b0507aa421cbe990922920d0b22f
SHA512 99a9d8247ece7e4fa2498acd9c94fd1213e48c872cc9d43020eabcf8f97bdd0b60b31a26b7034b61c4bf118caf5a3c7acfdec9a13d060e21f33a38680eba8834
SSDEEP 49152:U+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpj:Zp7cp7cp7cp7cp7cp7DUHzg3SK2
TLSH
T1FDC76D06FA8344B1E96711B10CDFD2BE8566B6318B228DEBE74D871FAA32FD15834315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7efb0210a018fbaae27387b1aa82bda6fe4c0f74a81cf2cd425bcf148bd00aed
MD5 0b4b6c2840dc44c8cca1837548eb4db2
SHA1 24415b904c80be3f46952435a5db99631572b732
SHA512 8e64939a9237238a600adbf89fcb03d33c912972d03d4296e5b9afad300c3f2ef42eff80956b9d423ff15e2b356617980710a8ee13c2c33304e5d3e5962178da
MD5 SHA1 SHA512

Submit Download

svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCAABAACAABBAACABBACBCCCCAACACBBCBBCCBBCBBBABCBCCABBBA.exe
Size 8.3MB
SHA256 723a04c73fb2708ca1873bd433536c7adb79bb9ef5ef4101cb9ea176ee878df6
MD5 402943438ca64823744d8d00f074c711
SHA1 4b8d9214de8c42709cc5d4b843bee23dbf8650e0
SHA512 a87fa87decd861df0cb35dbd494cc8c8b8543b3c92e960456e8fd899948659ae6f47d4cf8fef0fe30230bec30f66e6f006f78edc3d2ecf150332195fa80dfaaa
SSDEEP 49152:U+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpd+ES+ES+E2+ES+EhXpy:Zp74
TLSH
T1FE966D06FA8344B1E96711B10CDFD2BE8566B6318B228DEBE74D871FAA32FD15834315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-88-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/3308-95-0x0000000000E40000-0x0000000000E61000-memory.dmp

Download

memory/3360-86-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3360-60-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3360-22-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3360-34-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3360-11-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3360-0-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/3724-33-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/3724-72-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/3724-51-0x0000000000710000-0x0000000000731000-memory.dmp

Download