af88eeda609ad8ff8c1a318d1f02352ebbe281921f6056b3879d7bd1ce5e3305

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
Size 1.5MB
Sample260818-y51bysbc28
SHA256 af88eeda609ad8ff8c1a318d1f02352ebbe281921f6056b3879d7bd1ce5e3305
MD5 a085f09c734901ec4d836bbd0e2d1c03
SHA1 661fdb1ef055862416a48917f91173d8bfb21d18
SHA512 ccc299c5219c2b75da8d3bb6bea4121defd26ac8ee2d138c3757aba0a841c422bad8d0915003e9e381e79bb55c6e82add6998133d3fea1be2d89d7de1ed1604f
SSDEEP 24576:m9+EM0qSafDd70iTx9+EM0qSafDd70iTx9+EM0qSafDd70iTlIh7CH:U+E8Dd79b+E8Dd79b+E8Dd79uhOH
TLSH
T153656C14B7D18035E5B314718EBFC27A8979B8315F218ACFA3C4863E5E72AD1A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
2588	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
4832	svchost_BBBACAABABBCABCCCCABCBACAACBAAAABBAACACCACBCACABACBBBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAABAACCBBABCCABBABAAACABCCCACABCAABABBACBBAACACCBAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe"	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCBCACAAABCBBCABBBCCABBACCBABACCABACBBCCABCAAAAAACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBACAABABBCABCCCCABCBACAACBAAAABBAACACCACBCACABACBBBBB.exe"	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1844	sc.exe
2488	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3208	cmd.exe
2152	cmd.exe
3896	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBACAABABBCABCCCCABCBACAACBAAAABBAACACCACBCACABACBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
Token: SeDebugPrivilege	1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2716	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3208	4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe	110
PID 3208 wrote to memory of 4692	3208	cmd.exe	112
PID 4780 wrote to memory of 2152	4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe	113
PID 2152 wrote to memory of 1844	2152	cmd.exe	115
PID 4780 wrote to memory of 3896	4780	2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe	116
PID 3896 wrote to memory of 2488	3896	cmd.exe	118
PID 1772 wrote to memory of 4604	1772	svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe	120
PID 4604 wrote to memory of 5056	4604	notepad.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a085f09c734901ec4d836bbd0e2d1c03_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCBABCBBCACAACBCBCCBCCCABAABBBCABABBCAAACBCBCBBBBACABCBACCABABCACBABBABCAACBBBBCBCAACBAACBCBACACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCCBABCBBCACAACBCBCCBCCCABAABBBCABABBCAAACBCBCBBBBACABCBACCABABCACBABBABCAACBBBBCBCAACBAACBCBACACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe" start= auto displayName= "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe" start= auto displayName= "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBAABCAABABBACBBACCACCAAAACAAACACAABAACBABCBAABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
1⤵
- Executes dropped EXE
PID:2588

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAABABBCABCCCCABCBACAACBAAAABBAACACCACBCACABACBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBACAABABBCABCCCCABCBACAACBAAAABBAACACCACBCACABACBBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d24841b4802eee612ebd4f812039626de1f0905133d78c5d21a966b2e649c6e4
MD5 01b4458cee4ce9a92b719f1f32a26647
SHA1 e4a4e45a8a1f3b86f7ea368ab6a75347234179ac
SHA512 c37c214781ee7147b77ddc41342e73e909bae7966018226167aee6f8d8f65164016d24c0a42a346aad312a8e369142f5f8e66f4afe393346e5fec1871bf79b57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f95f33a7f7d2dbfdac678bfdad560891354e05e35530967fce9c06d0a4d250a3
MD5 38c7099628715d2dabaa991653009d8d
SHA1 d942a9dd5f840f53727016db387075852282b2d4
SHA512 02216df039ee5d95659cea5562eca6c29018a5aaad0151ac674fbeeedec8d37cce244829081d52231ff63763da233eb5ad2ff4722c2afd9bf8ca7bb42adc5708
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e7cc43d181e8d79571bc138414fc9001c290c329eb8042834cc992fc9dd428f6
MD5 c4049efcf8b8944c3743e233aa745d40
SHA1 1e9d7b42f9d3311f82d58008d490b5d2dbca3348
SHA512 bf8bbf5ae58e98bd867490bdef75d0f7e57c50ca335c701486ca925559228c9388be908e166a18abfd5cff3f03e985388639459a505aa785635dbc33fbdf9bb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ccfa1e387dcbbd74585333d60907fc1a24d18ea9dbb344463a15bfe77ddb56b
MD5 fac3b72e594ba16d782ac030ee032f4d
SHA1 954ca23914e2cc06724bbbda115e4fcc8659c471
SHA512 f50b66af7e03a5389dc78a8691dd6e878ad1733989f8deeba49d59989d8950e0237bf6970b9dfb103f838f2ad27b81cb0568b3228676c1e8b48cf2e7c900cfc9
MD5 SHA1 SHA512

Submit Download

svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACABCCCBAAAABBBAABCCBCABABABCBCBCAACBCAABCCBCBBACBACC.exe
Size 1.5MB
SHA256 af88eeda609ad8ff8c1a318d1f02352ebbe281921f6056b3879d7bd1ce5e3305
MD5 a085f09c734901ec4d836bbd0e2d1c03
SHA1 661fdb1ef055862416a48917f91173d8bfb21d18
SHA512 ccc299c5219c2b75da8d3bb6bea4121defd26ac8ee2d138c3757aba0a841c422bad8d0915003e9e381e79bb55c6e82add6998133d3fea1be2d89d7de1ed1604f
SSDEEP 24576:m9+EM0qSafDd70iTx9+EM0qSafDd70iTx9+EM0qSafDd70iTlIh7CH:U+E8Dd79b+E8Dd79b+E8Dd79uhOH
TLSH
T153656C14B7D18035E5B314718EBFC27A8979B8315F218ACFA3C4863E5E72AD1A934B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-26-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/1772-39-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/2588-75-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/4604-67-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/4780-0-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/4780-7-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download