33f4785a5f32af64c913f46bf60aba88b374ac5b77fec028cec0ad5ff9838d2b

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
Size 3.7MB
Sample260815-wf55sseq2v
SHA256 33f4785a5f32af64c913f46bf60aba88b374ac5b77fec028cec0ad5ff9838d2b
MD5 9838933980791e8c79d6201e8da8254d
SHA1 29e41a89e07e49c136291e71444c9108125c9733
SHA512 50a3e1655edc32873901c6854ed1c69b0a5a3daa07e2136b6908145ff39092d85a3510adefc24cde3e53f71543a3727004b9d9a698012ccc384e99ec89fd885d
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2I+EPiw2k+EPiw2k+EPiw2k+EPiw2NDd79WC1:Bp7n
TLSH
T178064B0977ED4824F5B7723489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
5944	svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe
3172	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACAACAABACAAAAABCABACAABBCCBCABCBBACACCBBCCCAABAAACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe"	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABBBCCCBCBBABBBCCACAABCABBACACCACAAACBCABBBBCACBAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe"	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5812	sc.exe
3232	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
400	cmd.exe
4788	cmd.exe
2676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
5944	svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe
5944	svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
Token: SeDebugPrivilege	2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
Token: SeDebugPrivilege	5944	svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 400	2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe	91
PID 400 wrote to memory of 3052	400	cmd.exe	93
PID 2384 wrote to memory of 2672	2384	svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe	94
PID 2508 wrote to memory of 4788	2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe	97
PID 4788 wrote to memory of 3232	4788	cmd.exe	99
PID 2508 wrote to memory of 2676	2508	2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe	100
PID 2676 wrote to memory of 5812	2676	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_9838933980791e8c79d6201e8da8254d_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAAACACACBBBCCCCACBBBBBBACBAAABBBBBCABCBBBACBBBCCACBBCAABABABBBBACBABBACCAAACCCABBCABCABACCABBAABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBAAACACACBBBCCCCACBBBBBBACBAAABBBBBCABCBBBACBBBCCACBBCAABABABBBBACBABBACCAAACCCABBCABCABACCABBAABCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe" start= auto displayName= "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe" start= auto displayName= "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACAACABACBABBCABAAABACCCCCBBBCAABABCACCAABACCABBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAABAACBACCCCBBBBCABAABACABCBBCCBACAAACAABBBAABBBAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
1⤵
- Executes dropped EXE
PID:3172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be95dc28007b3dcb54f4d75d984dfcd30bb12f368c49be2683badb5b36166428
MD5 d2dcca929c8fc93e1a16a833f277aedd
SHA1 ffc8960a9bf32336c8b676d07eb49d3cde8ce899
SHA512 3714dc0b1a55d247a8a82c6cab6a9f0720d58bdcf8453e28bb6991342c3bf73967ecfe69c2f43e3f4c3686bc047020d16321dd0befed8ecfcc147d23589c37ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9eaaef73ebd8d46aaf01dfbf991529e7d616b63b5a1a9fc8d63856902107b60
MD5 13d102f339986ef413e3ec6083ef2100
SHA1 d25fdbd3e04e40a83ff92d61a66f80dc42f0ee6b
SHA512 1706f3708fdea8d038787867de62c8663111e4a068de9d00b1ea64665c761cfc85acdffba29778105e3165579592781bb5f3c9b69c873d1c41e71371b1c3be7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ab9710e754cd9e5fb90c8edc39302d7733d44ef719d059d87ccbe92000cc1fd
MD5 e208ad125af3b22dc85d894082b06ad7
SHA1 714f7cf888a53ca475e8c00844d4ecca9dc210a3
SHA512 3e787452f2d8d7ecb5357984b95173b5269036b980342096a877b399ace423fef258c775f5a045521e267c9ad803ecbfa944df83133bb75e5aa58914b958f2b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0ff3b9a73f4fca2cca717e9e6dda389d4ca39811c1cf168a20e362e114678e79
MD5 a63f0c4c5b3a0791dd46da61d5eea263
SHA1 52077840a11af94015fa80443af2a02808993733
SHA512 46cc84a2267b236af624d7c35c1e0a53b08e6045d64ee90b74792d2c8ea2d6dca9fbe4b89c0683ab3852117f393c776dd4c1da9582f9c321230145e33772ffc4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 90e974af90542293c864561c7108e60773acb171fde8e27e3e8c8841fd153baf
MD5 769966b1c8c5ce8105aaea6d9a166693
SHA1 bdf649d06e56eb2081b465ced187d3b05c4b6262
SHA512 c5d322b32c74855660a101070b811d703c38581b794177186b65ed5eb89be7e2bd9356cdc3678614d22199c940165d2fb8eeed9bdb5ff648e317a07b90cc161c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ded1fd7744ccb9703c7f5c0394066e5174905b0a1ca1a3a4983d8efb5747c33c
MD5 d11fcb19df6f22a9eb18839babc8b44e
SHA1 ed97809868764e2b88195a0a431911ae73d0750f
SHA512 0f5317598b9d35560dbe700d37234710ec428cac0d7533557dde5e743bba00a022df02e5e1c70c2fb57dca082b95b3297b471bed25b95662d5878fbfe52e6165
MD5 SHA1 SHA512

Submit Download

svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCCAABACACBAACBCBAABCCCAACCCCBBCBCBABBBCACABBABCBBCB.exe
Size 3.7MB
SHA256 33f4785a5f32af64c913f46bf60aba88b374ac5b77fec028cec0ad5ff9838d2b
MD5 9838933980791e8c79d6201e8da8254d
SHA1 29e41a89e07e49c136291e71444c9108125c9733
SHA512 50a3e1655edc32873901c6854ed1c69b0a5a3daa07e2136b6908145ff39092d85a3510adefc24cde3e53f71543a3727004b9d9a698012ccc384e99ec89fd885d
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2I+EPiw2k+EPiw2k+EPiw2k+EPiw2NDd79WC1:Bp7n
TLSH
T178064B0977ED4824F5B7723489B68669D6B2B8915B31C7CF9280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 523dc6efd6740763747e7a50319c8801e5c338128595eae324274ac7bfdaae59
MD5 f334eb2719e9e3b0b0b50c9a8b021eee
SHA1 ab6ee3e2f7113033bcfdf44be8cb32115c1ca6f1
SHA512 6a9e848faa32bfc5b435cb3377935de06483b708b559b396a4294b64366e054b86d7765b1731b6af88792fcda69e60b5649f80532e0a155e599cd58eebea05b8
TLSH
T109110A73B4E5D863FC72A8DE5DA9CBC31DE43A6B685C6E1823084518BBD9C318D194F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2384-33-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/2384-23-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/2508-0-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/2508-7-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/5944-79-0x0000000000490000-0x00000000004B1000-memory.dmp

Download