256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Size 10.3MB
Sample260818-dbbfhsvbqh
SHA256 256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986
MD5 cffcd1775547f247f5c2835c5f2fb3c1
SHA1 b7a7b84a5ee6a0797618c1381623cd160b317423
SHA512 65663e68dd5639cb52ad00982b4eb286d4d471f6cb07eabca39b1a32649a14721fb1f93e7144e1b9433ee1416fb813ec25afd8bb9acd2c8b9654bd7464a505c5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:5Bxp7X
TLSH
T103B65B09F94340B1D92B10B04DDBD2BF8A70BA2587128EEBF68DDB1B7933BE16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
5880	svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe
1112	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAACCCCCAABCBABCBCBCCBBCCCBABCACCACBBCCBCACAABCCABBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe"	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBCCCBAAAAABACCBAACCCBBBABABCCCAABBCAACAABACAACBCBCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe"	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3196	sc.exe
6072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3124	cmd.exe
1668	cmd.exe
2636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
5880	svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe
5880	svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
Token: SeDebugPrivilege	2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
Token: SeDebugPrivilege	5880	svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 2636	916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	91
PID 2636 wrote to memory of 1152	2636	cmd.exe	93
PID 2056 wrote to memory of 880	2056	svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe	94
PID 916 wrote to memory of 3124	916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	97
PID 3124 wrote to memory of 3196	3124	cmd.exe	99
PID 916 wrote to memory of 1668	916	2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe	100
PID 1668 wrote to memory of 6072	1668	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_cffcd1775547f247f5c2835c5f2fb3c1_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCABABABAABBBCCCBAAABBBCAABACCABBBBAABACBACACBBBBABCAAABAACABCBCBABACAAACACACBBCCBBCACABBBBACCABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBCABABABAABBBCCCBAAABBBCAABACCABBBBAABACBACACBBBBABCAAABAACABCBCBABACAAACACACBBCCBBCACABBBBACCABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe" start= auto displayName= "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe" start= auto displayName= "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABAAAAABCCCCCABBCABCCCCBCACCAAABABAABCABCACBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACCBABCBACCABCCCBABAACAAABACBCBBBBBAAACAABCBACABACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
1⤵
- Executes dropped EXE
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26004a6d879f7efaf2efebe5bc353a435885dc6f0ea001cc084fd263147cb93c
MD5 e4f04bbee5a4c6e308662fc04b29416a
SHA1 21cb943518e93f03db0c34944b72af961a64b979
SHA512 6449603a53cefa189d7b8aa8a59114068e5f9201472e4e4d8ebcb0fe461cb67f00a4c5ade5db54ab8a41e93a4a1fe8993facbaa78e9d77d45d746f3fb88d10a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c0b8a9f0c2c4af7c45926b4499fd882d05c02d304350e027333c5494da3f9427
MD5 1742449894bbf3945d1ca539b5b9c3a0
SHA1 cbcdfa73a409524e9cdba5962c53cea6ecbfb616
SHA512 b3f2a8a47e9354036aeecacfdb8e67629e6755a7e5004ba75c617ee18e28741881f67430367a374299e26e85d94da89375588be7928b8ee026b5b41e843c8df8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95bb5d2e4b9a9fe3baf7b00bc5b6c8b92c8960eb27ae2bf0090b87cee90f5c78
MD5 6f05da5d478a69cca8c10333d5423233
SHA1 fd0e22bc4b65b99de4a7feb3273c9c82e421191d
SHA512 1e77e3484114eadc4862c325593c13382371e14adbad8317d31b83969ccda2e09aa6d5fa22214659cefc20356ab8c27d56f902e719932857beea3ca1ec6902ff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 36151e4d2c243ad0861a9f0f5c0c05e9341cab84d4b02aedab7c2293c8a8cf4b
MD5 154153d18a8534def2ad6a53671bd819
SHA1 d6542514ea37d2f529d80e5207784bffaa770100
SHA512 8f8cc17b060871798aef38a02b23f8027825c81d0e9b50ea7b27e5cab30bd55503a4a7f4007b8a889b35becf78f1e14bee703731d5555de199bf903f9aaa7de7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d3ec90472837a44bf2302c06f28f40213ca6b6336a5a3a6f735d3707e6f4718
MD5 9aa458dde677732bb2cb29285ca8cde1
SHA1 263dff303485306a877d45dba771c4ad0f4276d9
SHA512 9424774cd86e8575eb40660ea59ac4971299eb5a05150f440b5315c234c0dd25d4b333e7e30189fcacbe6139fbebd91f5ac6a98f10dca81ce88ab71c062aa3c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c24f593072f249de5d671d364ea358e8a8a7ca8ae9e78b7ad3120bd6fb11c84d
MD5 93d7c89493fba4205db184e153f2df04
SHA1 962944b177581129b3c5215fb93aae3d6e53461e
SHA512 fdc468989d3fa9edfcac1b2a8ca993f52ad24904da902157b26b707fabf59cce7067bdbfff662f7332aacfc6a81729ba0d098b591bbb0d87b2dff769817f6df0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 13dbbac133dff4bd3a8ecd63581f4bf0f7412728ec1538a69c676c17e156444e
MD5 f61d3119e35eaf8993bd3804139f5d16
SHA1 0505e69d9f5d6ef4c03a14fa967feba99b1c3bc0
SHA512 e34f0581e9f6eae5d142d3832420c33e17f48f9857c5b01c87c05f961e9e15d1fae1a245ec5221651910223d40aeae5e5e0069de120b7436cdcc7ce12cf9e9f9
MD5 SHA1 SHA512

Submit Download

svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACCCAACACABBCCABCBCCACBCCCCCCBBBABAACCCABAABABBCCCACA.exe
Size 10.3MB
SHA256 256a79da9b76a334296cddb760656fff6b1cb17786417ef780e08ebc9f9b8986
MD5 cffcd1775547f247f5c2835c5f2fb3c1
SHA1 b7a7b84a5ee6a0797618c1381623cd160b317423
SHA512 65663e68dd5639cb52ad00982b4eb286d4d471f6cb07eabca39b1a32649a14721fb1f93e7144e1b9433ee1416fb813ec25afd8bb9acd2c8b9654bd7464a505c5
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+EU:5Bxp7X
TLSH
T103B65B09F94340B1D92B10B04DDBD2BF8A70BA2587128EEBF68DDB1B7933BE16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 549e6b90a9dc97f2a64f04782a085fcb366383fd6f86bfef7e93a382fdf5f51d
MD5 76b443c2ac3b9023d7677452e86fac48
SHA1 662c01e5be611638e051d02dc714bcedd6202774
SHA512 da5a6e5fbce2a32ddd0bf7518c4ca83f64689ad1d66db28e0e834ce06e60469568f8f60f6e26bbbac323de711892b9729ce5beb8e6594daa872cf0cf06658f4f
TLSH
T14411C17194F7D467ED3238CB9229EB825CE837AFAD587A54130942187F6A8318E190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-8-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/916-0-0x0000000000A30000-0x0000000000A51000-memory.dmp

Download

memory/2056-34-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/5880-71-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download