9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Size 1.9MB
Sample260828-1f571stdpb
SHA256 9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf
MD5 13eb4f787ff5a56e73b951802c1d710a
SHA1 9558ab7bca98c48fed72d5364b04482b9d9fb942
SHA512 9c91673137a8b89ab4c593221dccb44154b1f0aaf35bf5f06f81a2f63adb26a0fc26658666abd4f4fb663ccccf7400540a6876daf4dba35c6b20181e559c6065
SSDEEP 49152:U+EJ+E7+Ez+ES+E+hO0+EJ+E7+Ez+ES+E+hOZDd79WC2:2t6p78
TLSH
T1B9956D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
4308	svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe
1344	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBACCCBAABCBBBCACCBCBCAAABABBACACCABCABAABCCBCABBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe"	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAABBCCBCCCBBCAACBAABBBCCCCABAABACABBAABCBBCBCCABCBBCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe"	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2072	sc.exe
1432	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4076	cmd.exe
2240	cmd.exe
3488	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
4308	svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe
4308	svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Token: SeDebugPrivilege	4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
Token: SeDebugPrivilege	4308	svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4936	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 3488	4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	98
PID 3488 wrote to memory of 1856	3488	cmd.exe	100
PID 4224 wrote to memory of 4432	4224	svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe	101
PID 4432 wrote to memory of 4268	4432	notepad.exe	102
PID 4720 wrote to memory of 4076	4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	106
PID 4076 wrote to memory of 2072	4076	cmd.exe	108
PID 4720 wrote to memory of 2240	4720	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	109
PID 2240 wrote to memory of 1432	2240	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCAAABBCCCABCCBCBABCACBCACABBBACACCBCAACBBCAABBACCBACACACAACAABCBBBCACAAAABCCCCBBAAABBBBACCBCCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABAACCAAABBCCCABCCBCBABCACBCACABBBACACCBCAACBBCAABBACCBACACACAACAABCBBBCACAAAABCCCCBBAAABBBBACCBCCAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe" start= auto displayName= "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe" start= auto displayName= "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACCCBBCABCABAABAACAACAAAABACACBCBCABCAABBAACCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4268

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCCACABBACABBBAACBCBACBBAACCCACABCBACCBBCCABABCCBCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
1⤵
- Executes dropped EXE
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3744bf8f5e3b08bad4dcd5cc2fa45983f10589077064af0f291756ea3c60fb41
MD5 ba7e2d9ab9633d60ef5c7147a41a4aea
SHA1 86c79f99a83f6741cf16411c6f1c094dbf74cd74
SHA512 802f313b6b925ab279923c2b9f2e697334f226f26e622dfc0af95518c9bb7d49a2f507d0867af434d1e71ab58835ee017138741dc543511eae7fa30967f9893f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e025ce811cdda7ceef8f54d30a3107f898c782969b82f5ee9cc9144086785e7
MD5 c1092a83315c97d8fdc7dfc4ff16ba6e
SHA1 a8395e3091a0f816339280eca148f69fa3c5b765
SHA512 5c879276b4a46c0ec9b0a28d7ac652fb561a5904e2562b0e0ba44848d861057dd969dc7572246359938049061d64de78d61fc8b109220f7a4b17dc80f8d9a148
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce14a3f3e04da64b6a8bdf35da3cb6a4afc5fc89b2beaa1d5c0bffa26692f961
MD5 a5df2da02d1913ad55272ba989e7ea3a
SHA1 4135ad9d314d4fb9d531652764ed2dd3b044349b
SHA512 2a443ebb34ba31544e396a9a022b4b834222ab161ff926e1cae0a857f24a9e8fa42dea162b97e19f086e8100f2cfc16e6d4b0e4830d752bca13dab61c46f004d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7df104becfdc1b7fd0045b8bc769d120e3d04fb481c1632a5a34e86b06efe92
MD5 f5ddfcca52b1505a25f31f592eba2c00
SHA1 771418363a827ce8a18172be83354e44cd44a9d7
SHA512 f366ea1e7337103d35bc2281c6e95d3447201a85aa9a7e472a2496efa2091017ec04b7a853191f1f03d9490403718cf3db570b5de26067083a11e339a2953551
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edecda2c692015ef537f9119293d4ba6829c13d7f99e30d0626b7ec074b772e2
MD5 c4cca00d521dabbe2db0327422b5a235
SHA1 c19aa0e39112cd9901790f8d1d3e6fbb676d90fe
SHA512 3b01205be2eac0403980d49425e2089df783f6818014f05ee9dce79b96ee9f2791aa276ecb719bd288dd38a2185cd675d5a2aa3f75d0d1a84a18204274295302
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 87b14a580158e1e03f22244e5a48432a2ec3696726d3ec8de2ec31bab752c26e
MD5 4cbe0b40c4b3d6f2551a1762980e32cb
SHA1 b3c73351f64136f8299177e954efe9101317c817
SHA512 1ec2fc00e02be020b6f59b02c7c8764dfd80f07d388ff9d933dc5e45135191c88ec871a156f914821b03ea2bded79579be09b70419d03f70a1e790a4c5cda2ee
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBBCCCBBBCBACCCCAACAACBACABBCABBAACBABBACCBBBCBABACC.exe
Size 1.9MB
SHA256 9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf
MD5 13eb4f787ff5a56e73b951802c1d710a
SHA1 9558ab7bca98c48fed72d5364b04482b9d9fb942
SHA512 9c91673137a8b89ab4c593221dccb44154b1f0aaf35bf5f06f81a2f63adb26a0fc26658666abd4f4fb663ccccf7400540a6876daf4dba35c6b20181e559c6065
SSDEEP 49152:U+EJ+E7+Ez+ES+E+hO0+EJ+E7+Ez+ES+E+hOZDd79WC2:2t6p78
TLSH
T1B9956D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 a1d76e882ac922f3a315afb04969b9ac779184235df414d4ac797c01f4b00dd6
MD5 581d157daf3285b40c61b93adbe8c998
SHA1 c99516a09e773d2ac5b57983be44ad895aa919c9
SHA512 063dac99c3abd93096148ef853954de79ebc838c5d66d7a7aaa76d1aecfe42432651f1e80bb2e12c76375f343ccc98629e7ea9f15178a331258a38f178d84808
TLSH
T1E311AB41F0F6D863F523248B5619AA866CD837CDA858FA15230D861D7FB9C31CD554E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-89-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4224-26-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4224-36-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4308-87-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download

memory/4432-60-0x00000000024A0000-0x00000000024A1000-memory.dmp

Download

memory/4720-7-0x0000000000890000-0x00000000008B1000-memory.dmp

Download

memory/4720-0-0x0000000000890000-0x00000000008B1000-memory.dmp

Download