743d06f686e84af26d3647038b2f768b6c1ba177c9862eb691a6dbe7f5ee10de

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
Size 20.5MB
Sample260826-2pmmpsbr21
SHA256 743d06f686e84af26d3647038b2f768b6c1ba177c9862eb691a6dbe7f5ee10de
MD5 684e4300d073189ec74a7d05c273205b
SHA1 e402de46b0f8dac2885f162e5f0e80bc20206413
SHA512 16cb4ab2d0eed2a4e92d1b03a292e983a4cba86a0d5a2dbab199d1ca3f03e16f0a928b66de69003938ab6dc4e326a457ea17e1858e23f350fcf3a0086a720fd8
SSDEEP 49152:U+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+Ey:vW1Psz5W1Psz/p73
TLSH
T13A273909F94344B1D92B51B04DCFE3BF8A60BB2587128DF7FA4DCB1B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
3948	svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCCCBCCCABAAABCAACBBCCBBBBCAABBBACACACABAABBBBBCCACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe"	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2932	sc.exe
4640	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1116	cmd.exe
1992	cmd.exe
800	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2604	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
3948	svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
3948	svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
Token: SeDebugPrivilege	3948	svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 800	2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe	96
PID 800 wrote to memory of 2604	800	cmd.exe	98
PID 2148 wrote to memory of 1116	2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe	99
PID 1116 wrote to memory of 2932	1116	cmd.exe	101
PID 2148 wrote to memory of 1992	2148	2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe	102
PID 1992 wrote to memory of 4640	1992	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_684e4300d073189ec74a7d05c273205b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBCABABAABABBAABCCABBCAAACABCABCCBACAABBCBACAABCBAACBBACACBBBABBAAABAABCCABCBCBAACCBACBABBBAABCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBCABABAABABBAABCCABBCAAACABCABCCBACAABBCBACAABCBAACBBACACBBBABBAAABAABCCABCBCBAACCBACBABBBAABCABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe" start= auto displayName= "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe" start= auto displayName= "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABCABABABABBBBACBACCCCCABCABCBABCBCCCCABAABABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
1⤵
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e726483a2f94a65dbb62a4f4aee4cbe6f9236e1475cb43e6ddecbf8c3cbc19f
MD5 332a6641c2c0fa067feb7c657c891e15
SHA1 d47775b19c9d3a54bb9cce7c53ac824793d201c5
SHA512 c9c88c3229321adb586bf8899c7444cbfb5bf785b3d0bdb374064086eee3dcae49fc33bcbd8c8eab690ecfe1b60edd7346730e1c9d26a095c09ac812cd5a602b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3edba34a9e7731d1fa206f8963bb8f3af02f3cd6112a504d535fcc57b2d2c308
MD5 6fc7c4675a4d9cfe1efa0bce3fb9b064
SHA1 c1398d8c63e9739d067fa82dbdab85bf623e78b1
SHA512 4820d140c3f04ba874f57236d798e5090dd9be9337616163421969973697e0aa828f644b42a93ae344e3a2fa35df64ef882964ef80a69af6ec3d2b2052a4a746
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f217f58fb22addb3bfd9f296abb112e44f1c7a4be4f8544557e21778f880c6c7
MD5 5124448334d08c92fff77454b5407629
SHA1 98763be95d7d78251445aef319acdae1900e6284
SHA512 cc93014ea872f48163deccbd5dd18f8d0909611fbae850f253a1cdadaef722fbf879944d1828b25574a55123a58ef80fe715619b16d940107c7662909b827c23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c297121e2c6537e67a7d394f47bd0f5d6901e0a4d0885bca83005720172ee0b4
MD5 3f04dc8b7b42a899251aaa06b07b7a64
SHA1 734a07a6cd47dda3dd7dbfeb2613d490f02badea
SHA512 a244823b346cdec914bab5dab269417a58f0c3bfdc1b3aee8a3af356940e18fcd52ba081b375aef8b57cddf0b4552995cbb5a087d1a011176a73aea1de0c2d89
MD5 SHA1 SHA512

Submit Download

svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
Size 20.5MB
SHA256 743d06f686e84af26d3647038b2f768b6c1ba177c9862eb691a6dbe7f5ee10de
MD5 684e4300d073189ec74a7d05c273205b
SHA1 e402de46b0f8dac2885f162e5f0e80bc20206413
SHA512 16cb4ab2d0eed2a4e92d1b03a292e983a4cba86a0d5a2dbab199d1ca3f03e16f0a928b66de69003938ab6dc4e326a457ea17e1858e23f350fcf3a0086a720fd8
SSDEEP 49152:U+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+Ey:vW1Psz5W1Psz/p73
TLSH
T13A273909F94344B1D92B51B04DCFE3BF8A60BB2587128DF7FA4DCB1B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCCCBBBACABAAACCCACBBACBCCAAACBBBABBCBAABABBAABBCCCCCA.exe
Size 3.9MB
SHA256 2738a7ba14c143088928e23c9d2a924991953cf1ac8a266db44242e99eed79b1
MD5 975f582e98c446956d08d2782d45985d
SHA1 7c057d459a095682698aca1ecee66f48ce6e5d0d
SHA512 2a879bedf5dfb3e8fcfa81b1be028354fd3c2d9d15f82b677df60a808785a09edc541c9e3fc15a999770b4d8bd2cdefd8133ae63138dcd89d36d69a5c87ac8cc
SSDEEP 49152:U+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+E7:u
TLSH
T1E3162A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-0-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2148-8-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/3948-27-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3948-40-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download