962e448260f23605339ff64c3139766cf4660fadae6fcc4d334d95e70f5c95b5

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
Size 19.1MB
Sample260816-sdgsmsdl41
SHA256 962e448260f23605339ff64c3139766cf4660fadae6fcc4d334d95e70f5c95b5
MD5 29c63ffd137a80f95bd64f90d5e232a0
SHA1 fa904dd4a68cb919396c867d8411427d0e059c55
SHA512 003ff92315164f98e5cc0acb7400f31c4188afe44aa828d1acd610188d05fcc5aab4c5afc63c9e50d556c3e458110c7dfedfe52a2c78d6962c01ac71509ab295
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Eo:hp73
TLSH
T1BF175C09F94340B1D92B10B04DDBD2BF8A70BE2587128EE7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000002440c-15.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
2592	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
432	svchost_ACCCCCCABBBBABCCBABBCCCCCBBBCCACBACCBBCAAABAAABABACABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABAABCCBBACCBBCBBACBAAACABCACCBACCCCBBBBCCACCCCACBBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe"	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBBAABBCABBBBCACBCBABAAAAAABCABCBAABACACABABAAAACBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCCABBBBABCCBABBCCCCCBBBCCACBACCBBCAAABAAABABACABCC.exe"	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3404	sc.exe
2428	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1360	cmd.exe
1040	cmd.exe
4516	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCCABBBBABCCBABBCCCCCBBBCCACBACCBBCAAABAAABABACABCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4340	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
Token: SeDebugPrivilege	5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4684	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4516	4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe	104
PID 4516 wrote to memory of 4340	4516	cmd.exe	106
PID 5088 wrote to memory of 4816	5088	svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe	110
PID 4816 wrote to memory of 744	4816	notepad.exe	111
PID 4124 wrote to memory of 1360	4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe	113
PID 1360 wrote to memory of 3404	1360	cmd.exe	115
PID 4124 wrote to memory of 1040	4124	2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe	116
PID 1040 wrote to memory of 2428	1040	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_29c63ffd137a80f95bd64f90d5e232a0_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCBACBCAABAAABABBBBACBBACBBBABABCCAAACBAACABBAAABACCABCACCCABBABCCCBCCCBCBBBABCBBABCAAAAAAABBACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBBBCBACBCAABAAABABBBBACBBACBBBABABCCAAACBAACABBAAABACCABCACCCABBABCCCBCCCBCBBBABCBBABCAAAAAAABBACCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe" start= auto displayName= "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe" start= auto displayName= "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCCABCCCCCBBBACBCABACCBCCACAACABCCCBBBACABCCABABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2428

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:744

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
1⤵
- Executes dropped EXE
PID:2592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCABBBBABCCBABBCCCCCBBBCCACBACCBBCAAABAAABABACABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCCABBBBABCCBABBCCCCCBBBCCACBACCBBCAAABAAABABACABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3cb4fab1a96a243b4b8b86d1a75b7f3edc66757d05cb6c6a7b3bc7b904c824a5
MD5 56ab6d3bf755e1baef3e769eeda54fde
SHA1 886752e9d6d12b283efe2039f12dfab5ad4e925f
SHA512 0326df5eae9b0bd6fa653a7af399db8d8aac7b07a89a9ef5a8a1c22373c1823d536f541cf436b9817626a56777c89ce3f7090db4b97d8350a98af840e3f3d26f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6e26819d0981ef7cc8e15c7d1d93c73255dbca68ac72c2ccfb3e0d349a44943
MD5 52ad75560480f63086b985db77dd8d98
SHA1 02f210e730002fc89ce911589ecbf3130ecb1614
SHA512 fd802389f8f4d683b99ae9a0826dd575589fa3407ea497aaa548ca149585aff633bb8f6c29e05c4d72c4f59f845c7f3cbd33afb3dd628c3a3671fbd8e1b8bc28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b65f26b41ab3152ef698128cb83ec33f92a5309da6753962706d8af466ab7d38
MD5 55fcff4f78c87f18eca93c53d3a8272e
SHA1 e92e4562ab35bb02666ee0b897eab83fdcc23240
SHA512 c66490f6ade0ef601a49121dcf1fa39e7945886d948e33a8988381d39bbb75dee8c9457b3600da2830a990c4c89f7381292bb2b0196ae636de6bcf8f0552eddf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b8811b6138d53fd2b8f76171e638eb0611bf5f3dba31f48f674ee573f35ddf7a
MD5 68fb3e2e2cc6ae0ca91381c8db050364
SHA1 62a4fb3c3b4fcb06603c9dac97e32f9be7572460
SHA512 04e59b90141887ca1f42e43cb6b072a8a105aaf4ce60d6700d3d714107cc2f30c1ec01502cffb70eea95351a89330029d86812933ff59ffb54926cfd3dfa560c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4b6385ea287ef1edb61bc9b706865e70bbfc6a68c21a988814ab3b5d43a82c6f
MD5 796cf65a2cda4a55f336596a03288439
SHA1 15cdee66050575866d178a8c3687c8a3875c7665
SHA512 da31bff7bf579f9514af27a88f108625118df8c172b11a993a089be74a39c4557c674e3aa6d62c4099b7350665847ab973b6e02dedc2959b53499ac66217e8e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 49593adf6cbe815ac3c17fcdf58b2e72dbb101c514bf780a7035ee0ca502f7fe
MD5 d3876ffbb2b345ab3701e312443675eb
SHA1 32cd96caba32e6149d48353a67eb30f4bd548222
SHA512 5c79d36d124aed89bc698d590ba4b7c68fcb68e91625d1a56bc3c304f7332d3caaa5deb5ec454a8f21e2e1430fcf2e186074750e2a1754ea8b4edf07622a264f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0236bfb7a63e494bd759287e23b98a06d2ed6a9e9260964b985537a5b555c984
MD5 f72fcf938f5fff0070a89bf3936b9781
SHA1 c4a04ec83d6281509e4ef8565d0a56e0008866f6
SHA512 b15918cb2460ce34f0df48dc23684c404059eddf6c763f6f5be8385ac0aaa7a32b8975627ac7fbeffaba115f482f413c0eba5682911595cbbe4325073927ecbe
MD5 SHA1 SHA512

Submit Download

svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABABBBACCBCCABABBBAACCAAABABACBBCCCACCBBAABACACCBBAA.exe
Size 19.1MB
SHA256 962e448260f23605339ff64c3139766cf4660fadae6fcc4d334d95e70f5c95b5
MD5 29c63ffd137a80f95bd64f90d5e232a0
SHA1 fa904dd4a68cb919396c867d8411427d0e059c55
SHA512 003ff92315164f98e5cc0acb7400f31c4188afe44aa828d1acd610188d05fcc5aab4c5afc63c9e50d556c3e458110c7dfedfe52a2c78d6962c01ac71509ab295
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+Eo:hp73
TLSH
T1BF175C09F94340B1D92B10B04DDBD2BF8A70BE2587128EE7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4124-36-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4124-59-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4124-75-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4124-0-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4124-24-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4124-11-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4816-79-0x0000000005870000-0x0000000005871000-memory.dmp

Download

memory/5088-52-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/5088-37-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/5088-76-0x0000000000960000-0x0000000000981000-memory.dmp

Download