e7cdff6a364b8136c68990096a114982fe6b9ecab2b8a088f5fe6913ef1e5530

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
Size 3.2MB
Sample260826-ld45lsbm3w
SHA256 e7cdff6a364b8136c68990096a114982fe6b9ecab2b8a088f5fe6913ef1e5530
MD5 ca4c1114102d2fc527bf23b9b5ecd881
SHA1 9d8fed3269fb8dd08dd6c0f7f99de537e43013c7
SHA512 32b96884048e41caa5638de78aa5dadea4b38e091accb6ba646a3a3992b7829d0291cd9cff212df52ae4a1adcd82003213adea3842cfcc87df4fe4f039aea22f
SSDEEP 49152:U+EI+ES+ES+E7+EI+ES+ES+E7+EthO6hO0+EI+ES+ES+E7+EI+ES+ES+E7+EthO0:6z7z2p7I
TLSH
T1E3E55C08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
4120	svchost_CBCCACCBBCAABBABAACCBAABBCCBACBCABBBABAACCAABBBAABAACBC.exe
4828	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACCBBBCBCCCCCCAAAACBCACCBABCCCAAABBAAAAACBCBBACCAABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCACCBBCAABBABAACCBAABBCCBACBCABBBABAACCAABBBAABAACBC.exe"	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACCCBBABACCBAAABBCCACCBBABAAACAAAABCCCAABBBBBBBCCABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe"	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5052	sc.exe
2496	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe
4236	cmd.exe
2192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCACCBBCAABBABAACCBAABBCCBACBCABBBABAACCAABBBAABAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6136	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
Token: SeDebugPrivilege	2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4456	552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe	92
PID 4456 wrote to memory of 6136	4456	cmd.exe	94
PID 2412 wrote to memory of 4896	2412	svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe	95
PID 552 wrote to memory of 4236	552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe	98
PID 4236 wrote to memory of 5052	4236	cmd.exe	100
PID 552 wrote to memory of 2192	552	2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe	101
PID 2192 wrote to memory of 2496	2192	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ca4c1114102d2fc527bf23b9b5ecd881_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBCBBCBBCAABCCCAACCBBABBAABABABBCAAACACBCAABBACBBCBABBCCABAAACABABBBAAABBBBBBCBBBABCBCACCACBCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAACBCBBCBBCAABCCCAACCBBABBAABABABBCAAACACBCAABBACBBCBABBCCABAAACABABBBAAABBBBBBCBBBABCBCACCACBCAABBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe" start= auto displayName= "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe" start= auto displayName= "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBABAAACCCACCACCAACCAAACCCAACCCCABCCAAAABBABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2496

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCBBCAABBABAACCBAABBCCBACBCABBBABAACCAABBBAABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCACCBBCAABBABAACCBAABBCCBACBCABBBABAACCAABBBAABAACBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
1⤵
- Executes dropped EXE
PID:4828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 581367117f7d3a8a784dd2de77bbdf6e7787ea9bfb4f9fc063dfc96b540fd6fc
MD5 7a590c0d5063a6e561cea75cbc69794d
SHA1 aac8159f5165ede2eb59d10388e05ce83f2abe8d
SHA512 ef24b913678c5611490450477a165796ef91a653ff9fbc0dd21c9adacfc484f877d4be5bdfd21f48361b28abb8a32f4945f3d9c97f6a3459aef45e57ea39a50e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be09b3015fe1a283e0e0aa55b5103764d192ece7c82b049386860e629099905e
MD5 007133c538051c3f4e684319fe33ceda
SHA1 92a9efd4e403f76760cfc111c98219180c5bcec8
SHA512 90dfa4461dce9cbcc67f6a0527cb5294f8cc87a7ea94fa5bd4f68a436e28ac88d7ecf736329583043ff06f40474f4ffc634e895576dc9bd90e453b17ed60f562
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffc7ad7fe46d8eca15136ed53d1f1737412f4d46fc90016d815decb7e361ff80
MD5 c62f8df00159cf7fc876cca12174e290
SHA1 d6e31f85506b5092d5121ca5429bc612b33d2acb
SHA512 57b53e1944ea4bf3bad944ab45e04faf47268ce5914a8db38ea41a06b91301b58e062d51b6ee459e94aff6d8d90ed4a92490201b28a340a585391c0fcf571bf4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4994061b4a120868edbd56553ff78f3c61b63d7e1561ff055ecea62df657384c
MD5 6af6cb800cec55597932e313d07104f9
SHA1 12a7002b8433d2e29c2d67acb784139dff184987
SHA512 99dd4dc43392ed87001392dbc6a1863d2abcfbcf7dc9e11771d7c5ba2ea8c3c17dcaf731a8377d21b81592718a078749735a9b32007d322b307fe71c09167bfc
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 10.2MB
SHA256 fb89582f53af3af9b4d9c33217af726aaaa9d7946ced4b855314cb750dbfd23c
MD5 1933a393c9d22bede4161cfb01789cca
SHA1 bbedef0e8df14743056821fe095e55e34841bdc4
SHA512 4fc6cd37a757b9715409ebebf5eab8fa32502d36cbe9fd6488cf958c5b23fe6d4b5edcb3f1a938fc239c9ce28caa261d70045093efd7e3bd7880b3f5f0d39045
SSDEEP 98304:6z7z2p7lz7z2p7lz7z2p7KYwUyPzJyjmJBgqVj1:/WWKCqzi8OqH
TLSH
T1BAB66D08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 19.7MB
SHA256 908f9cb926291bc997c9c391076c590b378abdad1c15c1f362b731619c3d7e6d
MD5 2eede29bfd66f3a572e187bb7de5d58f
SHA1 22522dc2427fdf2b126ba0d092ca94647554a9f0
SHA512 a24381d8ddac63f2ce0c3d7da00d368bebcc6a8fcb96b472f3927aa7824f4d2a96fd91d4271dfef9d4edb33f10f98880dd4c5cd3079f826b802120c9413def20
SSDEEP 98304:6z7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7KYwUyPzJyjmJBgqVjr:/WWWWWKCqzi8OqV
TLSH
T16A276D08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 22.9MB
SHA256 22feb659bb2a6bde77495b0c59e6f39c4ae592702857edaeedd3eeff364af612
MD5 5b2d7ebafb55a578107d72e9c882758e
SHA1 4b7290a617b31c2d20d67adfba3ebb7d448aa124
SHA512 1692d0afe827d48e2f9da0b169001c5f497d95fd6cad3732f9c1bbddebcf73697bde4958bcb04dd79d3bace6f3e330fd2efa669f2eee20248ed94b1ba82630e3
SSDEEP 98304:6z7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7KYwUyPzJyjmJBg3:/WWWWWWKCqzi8OqW
TLSH
T162376D08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 26.0MB
SHA256 ce03c33386c5992fe362af8b7b0a11710daa4b1b6254db1a8c0cf321e2805452
MD5 745e51aa9cc2e304af68d43feaae12af
SHA1 c0d998b2fdfa95fd875607da43ca53dd9838232f
SHA512 a1e2bd3d636abcfe334fc52e696a54b40ad37ec197cbe3247801385aff216e38555d126e7fca9ffe11519947b37afc72bd5f2b79bf09778bc76f57eb0762b77d
SSDEEP 98304:6z7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7KYwUyPzf:/WWWWWWWKCqzi8Oq9
TLSH
T14E576C08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 29.2MB
SHA256 4ebcd7ff17e83d4f0f029de8c03723cadd67455dd228fd8a6ebe0666c6bf4b19
MD5 18bed9141da65096b47d7974d00b0050
SHA1 b29d76b2bf97a6c799e79820f0461173d4c6b693
SHA512 dec1752ded7917092da77bdd2bf6ee135878a20dd2755daabc28cdbc293d82556b147c016c7db07465fab33beee9ef79539549d6332a6aeda3f28fd12fd159d4
SSDEEP 98304:6z7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7lz7z2p7K:/WWWWWWWWKCqzi8OqV
TLSH
T11A675C08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACAACACBBBBCAABBCCCACCAACBBCCABCCBBCCABBBABCCBAAABC.exe
Size 3.2MB
SHA256 e7cdff6a364b8136c68990096a114982fe6b9ecab2b8a088f5fe6913ef1e5530
MD5 ca4c1114102d2fc527bf23b9b5ecd881
SHA1 9d8fed3269fb8dd08dd6c0f7f99de537e43013c7
SHA512 32b96884048e41caa5638de78aa5dadea4b38e091accb6ba646a3a3992b7829d0291cd9cff212df52ae4a1adcd82003213adea3842cfcc87df4fe4f039aea22f
SSDEEP 49152:U+EI+ES+ES+E7+EI+ES+ES+E7+EthO6hO0+EI+ES+ES+E7+EI+ES+ES+E7+EthO0:6z7z2p7I
TLSH
T1E3E55C08F69740B5E877517049ABD27E8931793187218EEFE788C67FA933BD1A834B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-35-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/552-61-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/552-0-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/552-23-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/552-12-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/2412-49-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/2412-34-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/2412-71-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download