4dd905b3c280c6e41f90e90e09d88ef3222ac55b6100cd3b521cf11a5286d320

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
Size 3.7MB
Sample260826-e2kybasbqh
SHA256 4dd905b3c280c6e41f90e90e09d88ef3222ac55b6100cd3b521cf11a5286d320
MD5 e7aff92103eaaf892c947ad2fde89bf4
SHA1 f13ce1bb381d5a09225a5dfa72d64922739dd1db
SHA512 a98dfe016a820d9aa5520f1e8c8bdb126ef253850839fd4fe81d9e85599d91ac24728fe66545d685cce28cf3d3bf952e51e6f4af1f635fbf04a5b8230a2e62b0
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+ES+EV+ES+ED+ES+E7+ES+ES+E7+ES+ES+EjY58+ES+EC:M5U5xp7L
TLSH
T193063B19FA4340B1D92B50B04DCFD3BF8D607B2187128EEBFA4DCB5B6922BE16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
2344	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
372	svchost_CCCCAACCCABBCCCACAAACAABCCBCACBCBBAAABAACBCBACCCBCCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACCCABCABABACABCCCCCBCCBCCACABABAAAAABAABBACBBBBBCCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe"	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBACABCBAACBCBCCAABBBCBACCACBCCABCCBABBCABABABCCBBBCBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCAACCCABBCCCACAAACAABCCBCACBCBBAAABAACBCBACCCBCCCACA.exe"	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3508	sc.exe
1812	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2004	cmd.exe
4340	cmd.exe
2172	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCAACCCABBCCCACAAACAABCCBCACBCBBAAABAACBCBACCCBCCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
Token: SeDebugPrivilege	3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
60	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 2004	1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe	100
PID 2004 wrote to memory of 1852	2004	cmd.exe	102
PID 3720 wrote to memory of 720	3720	svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe	103
PID 720 wrote to memory of 3496	720	notepad.exe	104
PID 1144 wrote to memory of 4340	1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe	106
PID 4340 wrote to memory of 3508	4340	cmd.exe	108
PID 1144 wrote to memory of 2172	1144	2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe	109
PID 2172 wrote to memory of 1812	2172	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e7aff92103eaaf892c947ad2fde89bf4_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACAAAACABCBCBBCACBCAABACCBABAACABAACAACCBBACCCBCBBBBBBBCCAABAACABCAAAABCAABACCBABCCBACBBCCBACAACBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABACAAAACABCBCBBCACBCAABACCBABAACABAACAACCBBACCCBCBBBBBBBCCAABAACABCAAAABCAABACCBABCCBACBBCCBACAACBBBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe" start= auto displayName= "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe" start= auto displayName= "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBBABBCAABCACBABAAAAABBCAABBBBAAAABABCACABACBABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1812

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:60

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACCCABBCCCACAAACAABCCBCACBCBBAAABAACBCBACCCBCCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACCCABBCCCACAAACAABCCBCACBCBBAAABAACBCBACCCBCCCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d53fb0714f3cbe304a45364c77964ddc757787cef5aec10b88a2aa2c85a14129
MD5 76386bf8a7a7c18159000eaae94a0512
SHA1 0468395273335e97583d42c696644a8fa4a88bae
SHA512 4f76eccebe92b717314b18d742f35f8d84ecfec27539f149093f9c66edab21794354b89cb4d5409cadb7686b91da87c9d312eb540e8887e2372b29cd66791fe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4d02f1c301a92e3d7db38beb9eae09eb4a4207cae7aa05e21b9b750e6b5c0e8
MD5 994340f8159980087424482476dd6a6c
SHA1 b4ddb2f4b82cd5f632f7be1e818ee61c2577c9a3
SHA512 6e024e373d1636839fb4f787e740a3fa79e4e462964b4c0068c62e2d02ecb331e59c8d3079300e0f7c9c70a64d2021885bef64feecc7daa1acd3596ca945982a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69f72a08e5dcca4783758d34cc8fc6df8e10fbb8c1d10a40ea8e6ec76879ac92
MD5 e04a850b924f23794f776da888baefa2
SHA1 34d3a12554247111194f59ce88078c77f3768a5d
SHA512 d1f0d258d68e97c98834f7f0e930dfb6cdb15ecaa9b41d213f55dcc73a31a48fbba56f91f928f434145a15dc0a7cf4b2b3a86b538eddb352ea421f320686f59a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a35713f6088b72475b3f148ab94ec3a01858bde381332373a55d25ee35d1437
MD5 aa285f18c2b2e8c8ffff9c41041f0367
SHA1 e0021365d3874d73fd49d6457838a0def58787b9
SHA512 2e6bda126ae579cac32f2a6e75494d219842029c7c13f6c614a883cc26850e538789f90f1b81435228f5ffab4f0ac2b83bcfecc34735183692a764f629071e50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f34ca85840b1dbd84991a08d78e3740a7ddfc0e39dd7f3c03667394d8932dcb3
MD5 e3c65ec8d3d90a6778c1ea35c2a49c45
SHA1 f69d4b177329354c7cc4131eace50c40aa6d2c15
SHA512 18a54761c77166b73f30cb4e49ae562a8d902f6790df4bf94487f3dc9f2b9eeb6d45d0c2757c8809002e7a55611e6fbcd5e3a5854cde81138ba267fc7d7c0396
MD5 SHA1 SHA512

Submit Download

svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAAAACCABAAAABBABACAACACACBCAABBCCBBAAABBACABAACAABBAB.exe
Size 3.7MB
SHA256 4dd905b3c280c6e41f90e90e09d88ef3222ac55b6100cd3b521cf11a5286d320
MD5 e7aff92103eaaf892c947ad2fde89bf4
SHA1 f13ce1bb381d5a09225a5dfa72d64922739dd1db
SHA512 a98dfe016a820d9aa5520f1e8c8bdb126ef253850839fd4fe81d9e85599d91ac24728fe66545d685cce28cf3d3bf952e51e6f4af1f635fbf04a5b8230a2e62b0
SSDEEP 49152:U+ES+E7+ES+ES+E7+ES+ES+EV+ES+ED+ES+E7+ES+ES+E7+ES+ES+EjY58+ES+EC:M5U5xp7L
TLSH
T193063B19FA4340B1D92B50B04DCFD3BF8D607B2187128EEBFA4DCB5B6922BE16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-60-0x0000000005B80000-0x0000000005B81000-memory.dmp

Download

memory/1144-0-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/1144-7-0x00000000007E0000-0x0000000000801000-memory.dmp

Download

memory/2344-78-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3720-27-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3720-37-0x0000000000280000-0x00000000002A1000-memory.dmp

Download