5b57c10dac8975c7b909792ee2c7089a582aa7babc35512a10b69c02ab360df6

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
Size 2.6MB
Sample260816-e94emadk4t
SHA256 5b57c10dac8975c7b909792ee2c7089a582aa7babc35512a10b69c02ab360df6
MD5 4defa264c3fb3f5c187d57e452b68310
SHA1 6fa54d0b826a9bc37b70180653d3d0f62920064a
SHA512 bdf977780488ee4029cfefb716c86ecb13757c89021701980a56a442c75df1ef811599f09797a7da70f60d0acb08045ff7222f60d3d4f1cdd61d21ce5c347cc6
SSDEEP 49152:U+ES+E9B+EIC50XpH+ES+E9B+EIC50Xp4Dd79WCl:D5n5Np7r
TLSH
T121D54915B7D50035F6B356B08CBBC2B65D36BC204B31C6EFA644B21E6D32AD0E939726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
4568	svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe
2568	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABBCBBCCBCCCACCBBBCAAACABCBCBCABAAAAACAAACACCCCBBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe"	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBCBBABBABCAAABBACBBBACAAACAABBBBABABBBABBABCCBCAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe"	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1624	sc.exe
4952	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3548	cmd.exe
3940	cmd.exe
5728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
4568	svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe
4568	svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
Token: SeDebugPrivilege	4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
Token: SeDebugPrivilege	4568	svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 3548	2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe	92
PID 3548 wrote to memory of 4672	3548	cmd.exe	94
PID 4752 wrote to memory of 2348	4752	svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe	95
PID 2608 wrote to memory of 3940	2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe	98
PID 3940 wrote to memory of 1624	3940	cmd.exe	100
PID 2608 wrote to memory of 5728	2608	2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe	101
PID 5728 wrote to memory of 4952	5728	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_4defa264c3fb3f5c187d57e452b68310_amadey_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCBABACCABCCCCBBBCBCAABABACCCAABABBBAACBBABACBABABCBCACABACBBAAAAAACAABBCAABCBCBBCACABACAACCABBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCBABACCABCCCCBBBCBCAABABACCCAABABBBAACBBABACBABABCBCACABACBBAAAAAACAABBCAABCBCBBCACABACAACCABBBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe" start= auto displayName= "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe" start= auto displayName= "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAACABBCCBBCABCABCCABCCBCCBBAACABCACBBBCBACAABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCABBBABCCBACBBAAAABCACACBBBBCACBABBCBCBBBCABCBBABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
1⤵
- Executes dropped EXE
PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5ea1d72f78edf6c1aa0d05f1ee3ecd0e6605e95b84aa512f925ac5b5b2c941c
MD5 cd9e87f7cfa7101919e955262b11f026
SHA1 dedb101363aa2239085ab45ccb69c4fc89e1f94f
SHA512 83b56da6c686024a0be5dfd48bb0b218c314c76da256c6344d09865d18c10e4b351d71b1f57795ee4b661ddbdd478a18166235d855a58c43dbb0ee6cd42c3a65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0fee8274a3f981b61aa296c981c95deed0a6308b157b2b8a5e3a84b467e6450a
MD5 79b833c3f52d1cf02e218899e98b558a
SHA1 51b56b7c2e2b61966f11dde3c65723fe24971e9d
SHA512 2f248cc7f8549cf03f22edadefe33e2b487129c75b9b2b8fd9d075b2421a1682653447bc97f851aea241c772cd44409c58fe98afa4b1bfd4c1a55f59aa155391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 84f12e5fdb6c91c0184d5aaff9e78c78994cd2327173157a962000485085219a
MD5 78d1d3dc2d9c6c5ef3f9a46f152e7f93
SHA1 0af546a1b416381abf0ca2e79951a1de153435c0
SHA512 7f10c96cc909e7c68d0c23d906c3aaeb8c75cfbdc897a4cea73df663d9e72fe554414d68064cbe63546cf2dc027e419d0db0ac6bfacd792c1c5daeec3670dd38
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce237363d284343ffa5e48efee30c03da050b975df3bd36c242a67c935235192
MD5 7098087c0c5415dd6d0aa5b67df28205
SHA1 3cc1ac2c656c6076d89ad180ecd67c6314772062
SHA512 88de235c86ac16b524341d26c72234b1dc8f754c5a00143da284a4e7dbdf2232b632b65866cec5e7aeeb7e7ebc81adb894e94a137431bb44e11c5650fb91f83d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79005bc7a043695415a7ebaf28f40b4d66da0d8ef706b875e0962c2c71f55558
MD5 01c3ce50030c4160c207ba9b5b3e89ae
SHA1 f5ec7cc7f06e483d190ad7af5b97721b82648368
SHA512 b9d1b654052d60f878d2c1dd2019bc5e94c85c19ed09e2db1b8f9e6605855f0201ad704e5100f12906b1dcc6b19ee6674219bcb73c7f70c28389ae2518ffade9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61406ad5c91f19537490a3aaa8dceac1ea25d8418d72c13a8f0b548f6fcbffc9
MD5 5f091eaefa704ce9d3a0c32ad27016fc
SHA1 68fa403fabee5ba777018ac44ee786c5d772cd5e
SHA512 c23f3942bd005e3e4865232a6de9eb9feeb15e7232bfb1758fc854d4f66a3ec45ead3b346b70241df75b477ad81747614c5b1da1c303a3ab39ef38f20505f984
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 699331221413b029c2f610876aff871eb3e3ec97c253b528e7e5c228d3f2d015
MD5 8d07f93871b3a0b1c654145a876f5f82
SHA1 01683609f57c227fbf99ac9c37ac2c88a080860d
SHA512 fb4b25080417c9b99d62edc282f41ccdc1e8b3e07550a6fb5a1b8024b78c702997338c11b6a92bd40116dc4884c97b522e409576907f7a724c9f2e04866011a6
MD5 SHA1 SHA512

Submit Download

svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCACAACBBAABCABBCBCCCCABCBABBAAAAACBCBCAABCCCCCCCBACA.exe
Size 2.6MB
SHA256 5b57c10dac8975c7b909792ee2c7089a582aa7babc35512a10b69c02ab360df6
MD5 4defa264c3fb3f5c187d57e452b68310
SHA1 6fa54d0b826a9bc37b70180653d3d0f62920064a
SHA512 bdf977780488ee4029cfefb716c86ecb13757c89021701980a56a442c75df1ef811599f09797a7da70f60d0acb08045ff7222f60d3d4f1cdd61d21ce5c347cc6
SSDEEP 49152:U+ES+E9B+EIC50XpH+ES+E9B+EIC50Xp4Dd79WCl:D5n5Np7r
TLSH
T121D54915B7D50035F6B356B08CBBC2B65D36BC204B31C6EFA644B21E6D32AD0E939726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b172d6f042d2376e77b9e1c8f8fb33e2478f3d40b914b9f951aa1d901e99850d
MD5 8ba52b5c7bba69a8d155c739aab1a070
SHA1 83487c42908ca6e99a1113778acfbb7bd6026e3f
SHA512 229fac4b14279db9f10119631cae22610ba5001202a49f3d586d5b3a0780779bfe77da930f543655e18b96e212b9c66a29f6185c779d0a77e3645a8af0cba401
TLSH
T195113A60F8A5C863ED3268DB632DCED30CEA37DF2C5C6A9412090518E7D5D318E698E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2608-8-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2608-0-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4568-65-0x0000000000C80000-0x0000000000CA1000-memory.dmp

Download

memory/4752-34-0x00000000007F0000-0x0000000000811000-memory.dmp

Download