f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Size 24.9MB
Sample260819-ez3ekswfpg
SHA256 f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6
MD5 c9e128b343b49e6bc1d443276b9f3838
SHA1 66be5d14cda41604314e2f86a7482d3777493626
SHA512 7978790d62844e27bbf217a0e03870f62843bf8b8d6c18f42cb1072491258cf4cebb1cde6323c9d8031049f8993b6d44e9b549ea4d204cc46de923e802f27be0
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xlo5A+EPiw2Yb+EPix:brU5vrU51p72
TLSH
T1D047D40976E88464E4B7533489A1815599B2BC605B3186FFED70B22DDE3FAF0993CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
2768	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
1560	svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBAACBACCCBCBCACABCCCAAACCABABCBCACAACBAACABBACACACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe"	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAACCBAAAACBCBCABCBABCCABAABACBAAAACAACBCAACACBAACCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe"	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
936	sc.exe
4312	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
632	cmd.exe
1176	cmd.exe
2828	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
1560	svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe
1560	svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
Token: SeDebugPrivilege	3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
Token: SeDebugPrivilege	1560	svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 632	3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	92
PID 632 wrote to memory of 5792	632	cmd.exe	94
PID 3440 wrote to memory of 1548	3440	svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe	95
PID 3300 wrote to memory of 1176	3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	96
PID 1176 wrote to memory of 936	1176	cmd.exe	98
PID 3300 wrote to memory of 2828	3300	2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe	99
PID 2828 wrote to memory of 4312	2828	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c9e128b343b49e6bc1d443276b9f3838_elex_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCACCCCACAACCBABCACBCCCCCCBCABCBCBAAABACCACABABACCBABCCCACACBCBCBBCBBBABBAABCCBBCBAAAABABBACCBBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCACCCCACAACCBABCACBCCCCCCBCABCBCBAAABACCACABABACCBABCCCACACBCBCBBCBBBABBAABCCBBCBAAAABABBACCBBABBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe" start= auto displayName= "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe" start= auto displayName= "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBCACAAAABABBBBBCBACAACAAAACBBBCBAAAAAAAAABCBCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBABBAABAACCCABCCCCCBAABCBCCAACACCCBBBBCCACCABBCACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 96ee64862140c51cb285fc3245c452db3d6a08850cda280d21ee8e330d248c1b
MD5 b0c53d155db63e569364467189b40416
SHA1 72466aae387306e30df8ccfde6dd84d5b0d2d6ca
SHA512 4b41513bd8acd30407fd05d9008cb50bf286fc6017ec303f44b0bb498f7461d8f100b1aa82052ff029048515aa77bee7ce9959109bcfebbbdc9dbf1847594c7a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b1f34ce87e29f642a0c0d309e26418de9460f9e1be422d1819f49ddebe0f127
MD5 4f6b3ac12fe47fbc3beca822c05557dd
SHA1 c5934d6309a6dcb1810541d00c747e9fcda6e867
SHA512 4b63b02203cd1b204463c08efa029e327197aa4fe32c6ceb5d6d0e426ea998ae6eb0824245e5d7928eda5d19b2ba2163f05d0dd7b1088d75f34bfb6c0b5c13fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12bb13a1ca520022e63a39d2db4faaebef142aba20b7bc3dd95491865388fc28
MD5 0cf3047a9da29e0543a11e1c13b2aa40
SHA1 1c87cfed3668cabbb25870e1f437babc76bc9fa4
SHA512 998938b7fddacbaf571e337ae16a446d4fae0fcca79b236a00d391ee9349c5ab0fe9f0a6be44461a70b845a1b0384f1bcdb5fe77ae24f06891ff78d571477155
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 edffea23a801759d615bade00a904d05f110f96d42eb4d1c8f3c2f0920073532
MD5 fcfc63e508a25f48809dac8b4366c2dd
SHA1 24c2c00ca48978734831f85475ce49cce98972b4
SHA512 43bfad6feffaa2836101b13eb99fceead07e455fd663143bb3e40a34932a795cce5c90a05bf5d2465b3a70c56da080d9cac47599f4a93af95a584fb51dad8b4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e2e57ccc96a41759d9d40bce44bdfd9383a336791086465a0ccfc1f0a4f3cd1
MD5 7ab394169d8749ffbdb864ff5a107d6d
SHA1 27c82561d35595203a3e5baf0051d781f2a5399e
SHA512 64d3ddfb91e663a539e6cd342f3358442e2ed6a0e10a67fc1895858998073a96e175b5714c4d87e2e2ad907f29381a815ea994d0356e29657a75021066489ea8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9029ba0e61626c84548b7efa9195283646c7fbdb15b6c8a00fb8a170adf01df
MD5 ce66aadebab4e0f5730207b90424bc76
SHA1 2779c6716a7c695c73b8694b0d38b8a6c28c8b7c
SHA512 b2fda4fe799e6cd783788c15eebcd9030b14be3d2af53459e51601505f9347a3811fd304eb5a42159010a97dc83095ca89c38bc47a933a5804faf5b086814818
MD5 SHA1 SHA512

Submit Download

svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCBCAACCAACABAABCCBBAAAABBBBBBCBBABCACCCAACAACAACCBB.exe
Size 24.9MB
SHA256 f5b582216eff9a6229589d861602df1b50c8ed25790826c24ef293a4a7e3abd6
MD5 c9e128b343b49e6bc1d443276b9f3838
SHA1 66be5d14cda41604314e2f86a7482d3777493626
SHA512 7978790d62844e27bbf217a0e03870f62843bf8b8d6c18f42cb1072491258cf4cebb1cde6323c9d8031049f8993b6d44e9b549ea4d204cc46de923e802f27be0
SSDEEP 49152:U+EPiw2Yb+EPiw2Yb+EPiw2Yb+EPiw2Yo8obnyMWmddjZ7xlo5A+EPiw2Yb+EPix:brU5vrU51p72
TLSH
T1D047D40976E88464E4B7533489A1815599B2BC605B3186FFED70B22DDE3FAF0993CB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 88bb612e98791e34c12adfcbe0b5e06adb335a56925eaecbe98c20140822acec
MD5 0fb5e27b85334b06aa2c87a7af1a29b3
SHA1 3fff453fc4c8314e53f634e4356c97220d74286f
SHA512 62914ac306c70074e155067580c1fd1261bf41589eaa714b58e242e6b13af125fd025ac4278041e4f6c07ff4b1561962d6043cf01f46e85e659eb19c9f12097e
TLSH
T149110420D4F9E86BFD3228CF663DDAD288A4339BDC1CAA442308611CEB95D755D1A4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1560-72-0x0000000000A00000-0x0000000000A21000-memory.dmp

Download

memory/2768-66-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3300-6-0x0000000000F20000-0x0000000000F41000-memory.dmp

Download

memory/3440-35-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/3440-22-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download