9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf

Analysis

max time kernel
147s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Size 1.9MB
Sample260828-1f571stdpb
SHA256 9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf
MD5 13eb4f787ff5a56e73b951802c1d710a
SHA1 9558ab7bca98c48fed72d5364b04482b9d9fb942
SHA512 9c91673137a8b89ab4c593221dccb44154b1f0aaf35bf5f06f81a2f63adb26a0fc26658666abd4f4fb663ccccf7400540a6876daf4dba35c6b20181e559c6065
SSDEEP 49152:U+EJ+E7+Ez+ES+E+hO0+EJ+E7+Ez+ES+E+hOZDd79WC2:2t6p78
TLSH
T1B9956D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
1040	svchost_AACCBBAABBCCACCCBAABBCACCCABCACABCBBABBAABACACBAABBABBA.exe
3040	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBABBBAAACACBCABCAABABCCCABCCBABBBCCBCCBBBABABCBCBBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe"	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBBACACCCBCCBBCAAABCCABCBBBCAABCBAAACAAABBBBCBBBBCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCBBAABBCCACCCBAABBCACCCABCACABCBBABBAABACACBAABBABBA.exe"	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3028	sc.exe
5860	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2528	cmd.exe
2324	cmd.exe
1512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCBBAABBCCACCCBAABBCACCCABCACABCBBABBAABACACBAABBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
Token: SeDebugPrivilege	4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 2528	5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	92
PID 2528 wrote to memory of 4816	2528	cmd.exe	94
PID 4664 wrote to memory of 2108	4664	svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe	95
PID 5748 wrote to memory of 2324	5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	98
PID 2324 wrote to memory of 3028	2324	cmd.exe	100
PID 5748 wrote to memory of 1512	5748	2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe	101
PID 1512 wrote to memory of 5860	1512	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_13eb4f787ff5a56e73b951802c1d710a_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACACCCACACCACCCCACCCACBACABCCBBACACCCACAACBCACBACCACAAABABBCACBBBCACCCABABBACCAAAABCCACABCCBBBCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABACACCCACACCACCCCACCCACBACABCCBBACACCCACAACBCACBACCACAAABABBCACBBBCACCCABABBACCAAAABCCACABCCBBBCBAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe" start= auto displayName= "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe" start= auto displayName= "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBABCACABCCACBCCBACCABCCCCABACCAACCBCBACAACACABBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5860

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBAABBCCACCCBAABBCACCCABCACABCBBABBAABACACBAABBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCBBAABBCCACCCBAABBCACCCABCACABCBBABBAABACACBAABBABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
1⤵
- Executes dropped EXE
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d303ebcb09e7ca4cc316d7fffe4e3fec1d054398ea23ba9c1833fe515a39f865
MD5 6540ae41c1f6c01eef50c8e0b411320f
SHA1 6619e2c133cce7ceb80f185ebf4a84177c81c099
SHA512 958bf225edd75839cb68ad50e044d3240a07fc1577536ccaa1a170db559988f7a97c91ed7f20a8c37343e70f0c6f7625240e52440d528b175cc9f960ad908471
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b57dbd8c37de6fd846cda185ff9be065ec61d293e58661486377606a85eb7bcc
MD5 c74d6469b6c08e9932ff6d18f7684d95
SHA1 4ffd0ecb2c4dc55635a17e06eed29a8e0bc0ebb5
SHA512 c925bf0b9a7e67179590a790a310b60bc22604944aab024374922ef0d26f15901c8398d49c8647d0b4239877c8791c72048c3f687fb22928d33ce6f05ba400f1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1d5bfa4978678db39cf5525b526260aa5ddba08f9b6542396d6fc7f807719eb6
MD5 ba615c5caac6c0eff9bad14d9c60f77a
SHA1 310b359a350cb5bc47a6f8279bc9889e95aa1b4e
SHA512 ceeb79302780682ea577585c3512c4eb57eb676f1af98c04e5b77464b16f7e1ed6139decbaed72094c94dd9414464fd3bd66f4e9dcee092a4cc09aca148663ca
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 6.5MB
SHA256 5a2cd554a61f5b39d7b6e5623d9b48f77a10751c3575c26cff68c5741c238be8
MD5 1ce98c8ad1d6c583b332593bba4f51c6
SHA1 cb9b1622a6d714e113cf0b849173cc8a788e90fe
SHA512 6f3d012a6291c04cde3cd707ff55ac8b1e21562992e5c6951eeff49b2357237b825c68e49f5887e591a2165da422a52e9c7a3c2afb82b3176a532fa11c9a78b5
SSDEEP 98304:2t6p7/t6p7/t6p7WYwUyPzJyjmJBgqVjj:/yyWCqzi8Oqd
TLSH
T1D3668E08F69640B5E977517049ABD37A8931BD314721CADFE788C63EAE33BD0A834B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 12.2MB
SHA256 edbc364f871b6fb2db33f246951f62ef02f2e0ba2e61f6f33b429158f7172a42
MD5 f78365c6fef21719153ca2c9a2fbb72b
SHA1 392a975b215b12e8f996c77628e8b3e966a08167
SHA512 be5f6076cd8f4c94d86d9f9f738f4cbd5e20e865baa439162906a9b0ad13a30661c8aece382948de700f18c5dfda2f68ee22b98888994ec41174a7959e699a4f
SSDEEP 98304:2t6p7/t6p7/t6p7/t6p7/t6p7/t6p7WYwUyPzJyjmJBgqVjA:/yyyyyWCqzi8Oq+
TLSH
T168D67E08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 14.1MB
SHA256 8b1246fc5eece663865426f7bbf2727343f0441ffd6aaea503cd94927e274eb9
MD5 597806a390892dc4be2911bd845ab217
SHA1 59ae19e4403017036f961eaf0dc1abd63d400ff1
SHA512 44e4e94a9bddb13c85f4496b728d0c278e55d5d8889e21e75fd5857f58396d040607938ded6e7e30c821b1b2eb3124e7868d5fe70639136bd71ba899f595f667
SSDEEP 98304:2t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7WYwUyPzJyjmJBgqVjg:/yyyyyyWCqzi8OqG
TLSH
T164E67D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 16.0MB
SHA256 be52f26e7f62229e1faca9a2a89efc84d8f74af8a7c125dcf00c289cf3404d4a
MD5 97a3b8b2d92ecc90de78683e9fee3eb2
SHA1 abdeba3d25ed4733b37f32b55c5e5a54b29790fe
SHA512 bd66c9c34f06387ba773baf15b22decbf65f188d004704a05806d8b8ff279fd8ed123279bc8a4e0a3517da57c5cfbed2477cf3de2e88a258c0692c1924a13b5f
SSDEEP 98304:2t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7WYwUyPzJyjmJBgqVjZ:/yyyyyyyWCqzi8Oq7
TLSH
T12AF67D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 17.9MB
SHA256 fdc09bb991c3c58c62dada0edb584347a823fe6471a3d41455e4b54b2fb82064
MD5 2823066c2ccf9d33d266e9f7b9dd7ef7
SHA1 cca20dff64e428957e4219617312232ab6c05be3
SHA512 793609dbcdb0c92d0ab59164b96f142b9856bf986dfe0be1dded245935b35c7bed1009fada5ca72c01f2f9e0385d32000a3ad6bf56dd1b0a60176e0f50320077
SSDEEP 98304:2t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7/t6p7WYwUyPzJyjmJBgqVjM:/yyyyyyyyWCqzi8Oq6
TLSH
T10F177D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 573d2ba8dc780b0154643e631c7025ca83589e6b2f502e69d4f4b0e34a57c5ff
MD5 b2952c1d47d93a613889070369fc57d2
SHA1 193d0be7ef1b3f32115dfb2781ccd1086443857b
SHA512 4ece1e8b466538da83ecfbcb4677fe57d6cf763f26a21ac8a0365ed44b47fc5acb0f532e7c1278365e86c6431874b862ad1ed2dba1638bd115f54cd1edc6ebd6
MD5 SHA1 SHA512

Submit Download

svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACACCBAABCACABABACACCAAABBCBCCCBBACBBAAABACABAACAAA.exe
Size 1.9MB
SHA256 9d63b1a31acb8ad4c5715ea9d9d05ab6b2c0985c7cafac4958acc3c1058f8ebf
MD5 13eb4f787ff5a56e73b951802c1d710a
SHA1 9558ab7bca98c48fed72d5364b04482b9d9fb942
SHA512 9c91673137a8b89ab4c593221dccb44154b1f0aaf35bf5f06f81a2f63adb26a0fc26658666abd4f4fb663ccccf7400540a6876daf4dba35c6b20181e559c6065
SSDEEP 49152:U+EJ+E7+Ez+ES+E+hO0+EJ+E7+Ez+ES+E+hOZDd79WC2:2t6p78
TLSH
T1B9956D08F69640B5E977517049ABD37A8931BD314721CADFE788C63E9E33BD0A834B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4664-49-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4664-34-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/4664-71-0x0000000000700000-0x0000000000721000-memory.dmp

Download

memory/5748-35-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5748-61-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5748-0-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5748-23-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/5748-12-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download