dd177467ac7efab9409cc44a79217cea3c11497a77b05d593c371c0d7db8df65

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
Size 12.8MB
Sample260818-cfat4svsfx
SHA256 dd177467ac7efab9409cc44a79217cea3c11497a77b05d593c371c0d7db8df65
MD5 9b20b6bc6e6bbed7cc9123bb1b54274c
SHA1 855c2da096c0338b22698a42a7076943917ebca9
SHA512 d3419dee1fdb95866f776b3178c11e2eb2c96cc92dd159f70525cf6a139a921cea47a5e681dcb996fda176b4872fb7d9b038fd0f47ebc7f728550c9e12ae541a
SSDEEP 393216:w5B525S5I525B525S5/5B525S5I525B525S5Z:w5B525S5I525B525S5/5B525S5I525B5
TLSH
T14DD62B18F7D71161F97756B08CEBD2FB5D307E2087318AEFE605E60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
1576	svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe
1616	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBCBABBACCCBCABCABBCBABBBABABCBACBAACBBBACACBCCBBABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe"	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABABCABBBBABBBAABBCCBCCCBBCCABCCBCAAACACACABCCBBACBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe"	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2932	sc.exe
5880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3856	cmd.exe
3192	cmd.exe
4944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
1576	svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe
1576	svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
Token: SeDebugPrivilege	3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
Token: SeDebugPrivilege	1576	svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 4944	1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe	93
PID 4944 wrote to memory of 4524	4944	cmd.exe	95
PID 3984 wrote to memory of 6088	3984	svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe	96
PID 1812 wrote to memory of 3856	1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe	99
PID 3856 wrote to memory of 2932	3856	cmd.exe	101
PID 1812 wrote to memory of 3192	1812	2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe	102
PID 3192 wrote to memory of 5880	3192	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_9b20b6bc6e6bbed7cc9123bb1b54274c_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBABBABACBAACBCCCBACCCBCACACCBCACACBABABACBBBCBACBBABBCCCABAABCBCBCBCCCABCBBCAACBBCCABAAAACCCABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACCBABBABACBAACBCCCBACCCBCACACCBCACACBABABACBBBCBACBBABBCCCABAABCBCBCBCCCABCBBCAACBBCCABAAAACCCABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe" start= auto displayName= "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe" start= auto displayName= "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCAAAABBBABCBBAACBBBABCACAAABCBCBBACBCBBBBBBCCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6088

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACBACBCABBCACBBBBBCBBAAABBBACCBCCACCABAAAAABAACCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
1⤵
- Executes dropped EXE
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82b620f875cb28529fcecf0b5e9a18a87d4858e8e3afe332b4d28faba9ced910
MD5 215e7f157714da55731dfd201e59c883
SHA1 0aba52dc48488c81c7020a1bc2b682efe7bc7c3c
SHA512 a658d4eb24f80f186e1c411da28b7dce1af9d5576f195db03869b3558e7b68c730d1a1ba5edb1b80fcd3b1825b305f2c1fd49b4795f1e43123e38aa07b083764
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37a8457f2bd516e35f57c39aef13ad567b9abdc2a70e74f476bc31731f081eeb
MD5 18b7044c6ac950918e6162ed2714bd62
SHA1 9c3c2a3fdbb39139f759589ea697435062ff4e20
SHA512 d8210016a2d343d6e05603e982cc4c21781a5480e458a9cfd94c87ac720de9b438738347620f7bbd76c6c4b4bee61d1bd6c477c8224de95b0f58a9060b315e34
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8443af60a0dfdaf9cc6a2a347b44cf14f64a2e160878766dea9b28fce8ea344c
MD5 c8240ce1ef7c5db00f9a9bf5105e75f8
SHA1 7b0a6df450c9a1cedba4b90149db65f100b20d4c
SHA512 0e2de66eec5229477d4e3d315d6caa92f0b5e2e7c068a6a57b8acf30eb0a6e7c2c61f087f1f63e1b3f516c1f4d92da106bcdf9c7192f7bd42f87ecd8fff6c001
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d40f493c01bb69cca883c2fd1e765a4448018ecd1ec7e9dcaa06b5a4907b253
MD5 7f47138a6f6ecd2f0da225fc055b8ece
SHA1 0384a1ee6a5127736c897a85c8fad4bdc40dc211
SHA512 3f5d9a5d903a525bf759023d3ff513f79c6a8ed14f41bbfd1bdae33b720e8a7c0252df50fb7c881ec173983d5e8e057934866a0b22dcfa08ebd0727396a2ee1c
MD5 SHA1 SHA512

Submit Download

RedoNew.exe

Path C:\Users\Admin\Downloads\RedoNew.exe
Size 896KB
SHA256 4dc4827c170ab13f4e750fc6d48de1e5df097578c4994d9be9051ea901367642
MD5 eaf6600a85603258ec8dc5052b2cfefb
SHA1 e4c0486112eb4e32df3f2b0f9a3d4c12c7084017
SHA512 7e72b1f56de523deb38362bb307f95819314a307452d9619a6d8c63e57daac54e486efc2b5e972c9ae2bb0aadd3c37b989fd312ffd3d308d87d52336907f95a1
SSDEEP 24576:m9+EM0q9+EM0q9+EM0q9+EMIrCn5WG9+EM0q9+EMIrp:U+ES+ES+ES+EzC5X+ES+Ezp
TLSH
T135151A18F7E71161F9B756B08CBAC2BA5D317D208731CAEFE604961D2D36AD0D838726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27664fe064e0cbd73d22f62d50b68d328bd9499a91470b52aecf9502d82b9373
MD5 c57c5efbad3c5435e8139c07bac169a9
SHA1 0852d720520231a491585dd63fc77f1760482060
SHA512 6401d5b81b4c5a18d6d4e81a7ba7ad7c83a4c919f269af56855c72b0c1f3cbb59cc98d592de1b15c602fb05690c9afe8bd9305aa56d1b4070751617d37c5f016
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ed189c7effd9775b558a2f8b934dc47ed11005ccfe540e342e1cc37ef4983c64
MD5 f9fc6d5f2ffbbcdff3e364e1ad1e93bd
SHA1 28db6b79a5483cffb0889fda28fdc67c0004ca3d
SHA512 27c4fe620d996e42bf58e307010b70e952a4d46f93422c4ea77908563875dadf10aa25c54e29e342be2372d7cb866309bf86911d17731578b7645b09d5ce18da
MD5 SHA1 SHA512

Submit Download

svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBBCBABACCBBBCBCCCBBBACAAACCCABACABABBACCACABCCABBAA.exe
Size 12.8MB
SHA256 dd177467ac7efab9409cc44a79217cea3c11497a77b05d593c371c0d7db8df65
MD5 9b20b6bc6e6bbed7cc9123bb1b54274c
SHA1 855c2da096c0338b22698a42a7076943917ebca9
SHA512 d3419dee1fdb95866f776b3178c11e2eb2c96cc92dd159f70525cf6a139a921cea47a5e681dcb996fda176b4872fb7d9b038fd0f47ebc7f728550c9e12ae541a
SSDEEP 393216:w5B525S5I525B525S5/5B525S5I525B525S5Z:w5B525S5I525B525S5/5B525S5I525B5
TLSH
T14DD62B18F7D71161F97756B08CEBD2FB5D307E2087318AEFE605E60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c43552a2a87b221cca5cf62214094dd43015d2fcf9d78a21b12c23a892a7a77b
MD5 77507b615ccd3778bb62d3b3bfce4ee5
SHA1 abfa908aa46c5a1429512263145a09631888bdda
SHA512 48fc471132b8d067a20d1864358a8be8a5745587a41d5a20afdeccfc917a45ab6a1592e1383abae941d443085a6fa2b6d16453473e41055c2f0d3da30e2bea75
TLSH
T19311E371D8F7DC17E93268CA962DABC34CA93787991C7E1413484218BFA9C31AD250F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1576-101-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/1616-109-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/1812-91-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1812-69-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1812-0-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1812-47-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1812-22-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/1812-11-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/3984-70-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3984-48-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3984-33-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3984-108-0x0000000000550000-0x0000000000571000-memory.dmp

Download