880d4856a38fb1de4152999eb6dfea13f930f9a4f2ce4b9c64debe7eae9f23e8

Analysis

max time kernel
151s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
Size 35.1MB
Sample260818-dpslyswtat
SHA256 880d4856a38fb1de4152999eb6dfea13f930f9a4f2ce4b9c64debe7eae9f23e8
MD5 80ea464ca044d25132dfcb011082d3d3
SHA1 02083de4b9ff2cd47eefaef2c01f9c5a4d4dfa6c
SHA512 9ef549cffac7f4500eeac21c74ebb2e03a21ef8e1dc6853c1c4e044c50d16c925e692903656a4fe903bcf8152efad0cb959fa96c4f04154e506d142435c6dae6
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ER:5p7e
TLSH
T1AF874B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
5320	svchost_BCBAAAACCAABAAABBABACACACBCACACAABABCCCBACCCBBAACCAACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCABAACACBCAACACABAAACBABABABCCCAACAABCBBCCAACBCCBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe"	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACACCBABCBBACCBCBCAAABCBCAABBBAABBCCCBCCCABCCBCCBBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAAAACCAABAAABBABACACACBCACACAABABCCCBACCCBBAACCAACCA.exe"	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAAAACCAABAAABBABACACACBCACACAABABCCCBACCCBBAACCAACCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
Token: SeDebugPrivilege	4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 4604	708	2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe	93
PID 4604 wrote to memory of 4860	4604	cmd.exe	95
PID 4476 wrote to memory of 1320	4476	svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_80ea464ca044d25132dfcb011082d3d3_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACBBBABACBCCCBACBAACBBACAACACCBCCBCCCABBBAAACACAACCBCAACCBBAAAACABCACCCBBBBCAACCCBCBCAACBBCBCCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACACACBBBABACBCCCBACBAACBBACAACACCBCCBCCCABBBAAACACAACCBCAACCBBAAAACABCACCCBBBBCAACCCBCBCAACBBCBCCCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAAACCAABAAABBABACACACBCACACAABABCCCBACCCBBAACCAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAAACCAABAAABBABACACACBCACACAABABCCCBACCCBBAACCAACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8be1f9130eb7419e5e1a396be12abdefe3ef1c4d3dea1a869c5a67d7eb7470c8
MD5 bece143d0157aa25e79adb3ad2b5280f
SHA1 e5068f78af71151b8e65783c04a7a8c6b3181595
SHA512 f9a0ca17518306509127754d200c731cee7d5be407b78a4122db8b3b2c64b08350fe0ee94cd5ffbda5befefd483be985b4546f65cfa253a9be745b5656b2e4f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a7e6f7afdf388e04244a8fa2ba23733da99612320ec7763cc14f7049e438d5e
MD5 32af716396868396312a4c141c72ad4d
SHA1 f1ad4a21a1b21bd58b594783a2c174e43f3e1af3
SHA512 6a1b1e9c048eb55b3e436ae66ed98f987ea6942ff6996591ac82e92844c9526a14526e169e35ac1ac4c47a623110bb1309a42961d8467ce21450e9e8bdf601c0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c7b468c810759e88087541520209cac1343669b79d73887eb2227a904334a16
MD5 d79f00c50beaa306e756524e4c011199
SHA1 a4f2cd0f51163ef8040369b130828655f3534906
SHA512 e8f4dbca9091362ed10f0398d5a21a983fabbfc40d7084fa0b132f1bf5f79d440b51282a88ca6aef06cc3f78c4bc3d4cbae0718453f16b1b87fd74e2e4340105
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a8c93d00c70ee4bb484a18014e76f54573e07d0f0be021bfb4e96a61aaba298
MD5 9503bf091f58c1a6f1d89aa7e7f8e68a
SHA1 b765bd0c94479d37e82fb4bcd70c648a0f1ff107
SHA512 974ea77145925173ea1a19ebb894440b7eaed533297921f023d1e8aaccd824fc88bbe95c4250163f1593b9e0f037819714522a0b35e754f349c419b5a2723a64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69b1fcdc86e7e9dce0c13eac09441cafe075a789e6f6b19d527ca7ddd6a70ad3
MD5 7a329f8329b24319ffb6fb195fd3da75
SHA1 9a16b3028f8e9c7a75777f6c52c5d60a526ca007
SHA512 ca533839caf4ea9fbbc8276916933420845f93a6bd1c75ee3f22b187dfd6c5fe22280d30bd9b563811963ffb6dfcfebfefaf1680b04ed63e327171169142372f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c262380311169463d998326a1592dc3a9fc7627e053f5b83bd50c7feb394dc79
MD5 78586ad25346646e12732346e2bb8c18
SHA1 4eb08364aa32a21dc716d03594cfb0da83c05770
SHA512 a00855ed113d58678ed618585424e87d0935f89f9a7129aed851531f52b2138b5121e63fea10292b1a89782b9c624890987ff0d6c1f6bc4fdf0e14ee06e70931
MD5 SHA1 SHA512

Submit Download

svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABACCAABBCCACBBCCABABABCCCBAAAACABAAACCABCCABAABABAC.exe
Size 35.1MB
SHA256 880d4856a38fb1de4152999eb6dfea13f930f9a4f2ce4b9c64debe7eae9f23e8
MD5 80ea464ca044d25132dfcb011082d3d3
SHA1 02083de4b9ff2cd47eefaef2c01f9c5a4d4dfa6c
SHA512 9ef549cffac7f4500eeac21c74ebb2e03a21ef8e1dc6853c1c4e044c50d16c925e692903656a4fe903bcf8152efad0cb959fa96c4f04154e506d142435c6dae6
SSDEEP 49152:U+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ER:5p7e
TLSH
T1AF874B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-0-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/708-8-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4476-35-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/5320-65-0x0000000000690000-0x00000000006B1000-memory.dmp

Download