f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Size 24.9MB
Sample260819-ez3ekswfpg
SHA256 f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6
MD5 c9e128b343b49e6bc1d443276b9f3838
SHA1 66be5d14cda41604314e2f86a7482d3777493626
SHA512 7978790d62844e27bbf217a0e03870f62843bf8b8d6c18f42cb1072491258cf4cebb1cde6323c9d8031049f8993b6d44e9b549ea4d204cc46de923e802f27be0
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xlo5A+EPiw2Yb+EPix:brU5vrU51p72
TLSH
T1D047D40976E88464E4B7533489A1815599B2BC605B3186FFED70B22DDE3FAF0993CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
4312	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
5064	svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCABBCCCCACBACBABABAACAACBABCCBACBCBCBAACCCAABACBCBBBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe"	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAACCCCCBBBCBABCAABBCBBCABCBBCCCBACBABCCBACACBCABBBACCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe"	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2120	sc.exe
1464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3604	cmd.exe
4604	cmd.exe
4928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Token: SeDebugPrivilege	4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4496	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 3604	1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	99
PID 3604 wrote to memory of 4700	3604	cmd.exe	101
PID 4356 wrote to memory of 3800	4356	svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe	102
PID 3800 wrote to memory of 1892	3800	notepad.exe	103
PID 1732 wrote to memory of 4604	1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	105
PID 4604 wrote to memory of 2120	4604	cmd.exe	107
PID 1732 wrote to memory of 4928	1732	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	108
PID 4928 wrote to memory of 1464	4928	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCABBCABABCABACCBCABCABBAAAABCBACAABBCCAABBABBACCCABABAAAABACABCCAACBBAACAACABBBACCACBBCAACCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCABBCABABCABACCBCABCABBAAAABCBACAABBCCAABBABBACCCABABAAAABACABCCAACBBAACAACABBBACCACBBCAACCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe" start= auto displayName= "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe" start= auto displayName= "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACAABBBBBABCBBABBCABBBBBABABBACBCABAABBCBCCACBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1464

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
1⤵
- Executes dropped EXE
PID:4312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ebc3a11ef0c32bcf30044cee5da8a4fef20bfe9a5d749c40fe709de3072427f
MD5 81c7e275c0ef99237ff66b23b4e6f77c
SHA1 706046e6b313a3bcad245a941b0c44609eb84fde
SHA512 44f01d61a41f123ff8778c4d823b2c81f342bf9780b2e989bd2109734577560556ac51a06230630c902e4d2c8ca7a4cd4d4a2eceac56c791889e678f77ba7671
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9029ba0e61626c84548b7efa9195283646c7fbdb15b6c8a00fb8a170adf01df
MD5 ce66aadebab4e0f5730207b90424bc76
SHA1 2779c6716a7c695c73b8694b0d38b8a6c28c8b7c
SHA512 b2fda4fe799e6cd783788c15eebcd9030b14be3d2af53459e51601505f9347a3811fd304eb5a42159010a97dc83095ca89c38bc47a933a5804faf5b086814818
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8c7f110c39c52711f3f3742d9ac4307cecac90a21b120c49275d943059f8a285
MD5 bcc97680ba14f6ab0e7c71eefb746fca
SHA1 6251235b4632bc56745e6bc72057df3abaac03ce
SHA512 35e6ffbc1922346f9e4baf8fddb050282498e9e51726608be82e3d3b026ca401d75adcf9da00d603066b810c3be050c3eb326e4a6b7830709d2897691995917e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2ba0b2a8544492c9cd5a5b38af2828fcd6d4b83c37e0cd576b42aa06aa0941af
MD5 5a9b3510072d856bbbefcbb2a1517a8c
SHA1 e9b6b5ced0bfc5a7ee17e1af24c85889dfd85308
SHA512 50063e14aedfaa1a780ddf2263872658a5a0c185741f93d66b30c4a00c303891c1f7f1c49a7d7703356580cef9b3a84fbd4e020db2e20b282c52c803b4e0e7a9
MD5 SHA1 SHA512

Submit Download

svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACABCCBBBCBCCBBBCBBACABCACABCAABBBABAACCCACABABBAAABB.exe
Size 24.9MB
SHA256 f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6
MD5 c9e128b343b49e6bc1d443276b9f3838
SHA1 66be5d14cda41604314e2f86a7482d3777493626
SHA512 7978790d62844e27bbf217a0e03870f62843bf8b8d6c18f42cb1072491258cf4cebb1cde6323c9d8031049f8993b6d44e9b549ea4d204cc46de923e802f27be0
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xlo5A+EPiw2Yb+EPix:brU5vrU51p72
TLSH
T1D047D40976E88464E4B7533489A1815599B2BC605B3186FFED70B22DDE3FAF0993CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe
Size 12.0MB
SHA256 f3aa9242f6182eff0f435ed4987e88242bc9367da91b84d0c5d779797279947c
MD5 0d7a0798faa6cd87541d20364ce7f3e2
SHA1 217849d32cc353619689b1b222fe16b09b72fd87
SHA512 e5aeb609ec1d1bc257928fab9587822c225c925bb7656b0ebf2d0e6f55edccba3f72150cd2eb2d70a939974842ae707fb31a756d981a507c4c7d240a158767f6
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xl:br
TLSH
T18AC6C309B6EC8464E4B6533489A1815595B2BC605B2186FFED70B22DDE3FAF09D3CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBABCCCACBCACABCCACABCBCBCBCAAAAAAAACBACAACCBBCCBBCC.exe
Size 9.4MB
SHA256 ac03b0d84df76b1680b77f95bc575d270e42503841d072c64a331488c670104b
MD5 0591647013a7637da589c32ec7082cfa
SHA1 e8eff47b7ecbec56864fb5d1da9e257d9854b10a
SHA512 431cc881ddf80fe71378bc559e1d981d170662c819294ed941223944b0128e3195d5867450e4f9d858a9ef71aa6597f9ecabc2e89f1b4f13425cd92db0575e0b
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xl:br
TLSH
T156A6D409A6EC8464E4B6533489A1815595B2BC605B2186FFED70B23DDE3FAF09D3CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1732-0-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/1732-8-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3800-61-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/4356-27-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4356-37-0x0000000000410000-0x0000000000431000-memory.dmp

Download