390f887b4e6606340ab287e5c82f91d16cdf5c32a3d5c95781a23d9eae6ead9f

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
Size 2.0MB
Sample260828-2b1bmstfkh
SHA256 390f887b4e6606340ab287e5c82f91d16cdf5c32a3d5c95781a23d9eae6ead9f
MD5 0c3b321c291444ffc8d592341963004b
SHA1 0c4abf8c6e94c277ec3225e56926dd325f861aba
SHA512 9c544d4e5f6761c448bb08841ec3c3588451c4ff87ba42cb04bee7074dcb395e7e2f792f834cf5d857832c645121f753c98df37ac3dc7091d9ce2ca4e58f8734
SSDEEP 24576:m9+EM09rYn5G4t1+qwA9+EM09rYn5G4t1+qw8afDd70iTWCD:U+E7Y5Vwqp+E7Y5VwqeDd79WCD
TLSH
T1E3A57B7437F40C12F2B755B6A9B1D6901C367A350338D2CF7999664E6D23BC0983BBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
5696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
4448	svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCCBACBBABCABBBBCACABBCBCABBACCCAAABCAACABABBCAAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe"	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBAABCBBCBAAAAAAAACCACBCCCBCCABBBBCACACBBCCBBABAACBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe"	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1036	sc.exe
4248	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
4832	cmd.exe
1124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
4448	svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe
4448	svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
Token: SeDebugPrivilege	4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
Token: SeDebugPrivilege	4448	svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 4588	6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe	93
PID 4588 wrote to memory of 2232	4588	cmd.exe	95
PID 6076 wrote to memory of 4832	6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe	96
PID 4832 wrote to memory of 1036	4832	cmd.exe	98
PID 6076 wrote to memory of 1124	6076	2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe	99
PID 1124 wrote to memory of 4248	1124	cmd.exe	101
PID 4696 wrote to memory of 1728	4696	svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0c3b321c291444ffc8d592341963004b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABABBBCACBCCBBAAAABBBCBCCAAABBCBBAAACACCCACCCCAACCAACCBBAACAABACBACABACBACAABCBBACBBACABCCBCACBCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABABBBCACBCCBBAAAABBBCBCCAAABBCBBAAACACCCACCCCAACCAACCBBAACAABACBACABACBACAABCBBACBBACABCCBCACBCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe" start= auto displayName= "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe" start= auto displayName= "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAACCACACCAABBCBCBABCBCCAABCBAAABBAACCCBCAABAAAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
1⤵
- Executes dropped EXE
PID:5696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCABCCBABCBABAACCBCABCACACAACCCBAABAABABCCCBCCCBCCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffbf2f42e53f61952201aefbacb4c6ed69fbd1302066d92fefaa32ca1893f3c3
MD5 7c1f00f3c7bcce90938f58ac636ee2b4
SHA1 1588a7c673d29dea39929502c273cedbd0ac523e
SHA512 7f24c9b86adf2d77e2ae88b8b752b7b1d178463b8802ea9ad18f7037809f40b92b0be7dcd49d9163b46138c6126abad41c9273d2db17d86ff2bfa9ff85a80fea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 69ef105b9821097a312bb3c73af086dbc7b0ccff6d116760a1ca12813b758ca9
MD5 c6f86a4f1bad578e5fc3dc00185093ad
SHA1 f929771fb07e1ef9da6f1a29e5745fd325e99f3e
SHA512 c2ac5fbc273417d8c7af396faa8970295a275679a10b7cf3e720d7bffb78ce728df6975ec966d7f9beab4389bddf29762aeb23a9b6774c2c6253e3b6d729a461
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3e154752cb52e02d6d54822973dee3d28c1528620fe62e72799f482994c61b3
MD5 2f31dc650b76499abdb40113dc3a2419
SHA1 e50e29676a95fc4217217809750ee09302f29dc5
SHA512 ada457ff6b6239852689ca1c055035c98ca4602bfd395d710d4272a1e06daa9a2241c3687129385c1b87c667b606f4a893aea3d25b87546779c97bb216feb945
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3624666e9ee2228eaf9e3bcef1d91094c4e38729ac202b61470b76d93121e2e
MD5 e9d8e31ecfd506ddd9671ed1cddabdcd
SHA1 4b31f560fe42cec48dc5de474688e7fd1805d15d
SHA512 8fbf8415219ef40cde4fb58ba3a4c1f2fddbc5f14aa56cd98ec40c23b2b99d41dd32a5213d8cb4754f74662cd7776255e562b7c8f74567df2e84264cb98c5225
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9fa8d568562f96f294fa63181b41b7bd3643866a86a382008f02246ee97c7a86
MD5 ea8c11d0db0bd0baa8bed0dca562540d
SHA1 27be8454dcf5fadc4b6bf251362d3a89e8929de6
SHA512 d47d8bd328cb267e55fe3cb371bf976bd856a4c30fdd8e0cce92cc83b143458d028648a9eb3560e934a2fef2e7fd33c4aa9a3f88b65d63addd7f637ced3aeef0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 964e367e1fcdc0981b765e356730095a4f773fd57e75461bcb3ab07283a9cde6
MD5 4f259e68e9e19a3753274a003506fdbc
SHA1 61b3e4bf0dda9f09b6f483f455c3bec84713658f
SHA512 6480b5ea9c080d98bc0fa657f5cebd546c697001f526bca677eea955721907568dc43f3ea46e002e2d38dd8446bf20c7c0bf8065ecf0cd6ab124a9483d7a1b32
MD5 SHA1 SHA512

Submit Download

svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBCCAACBABBBCCCCBCCACBBBBABACACBACCBCAAACAACBBACBABC.exe
Size 2.0MB
SHA256 390f887b4e6606340ab287e5c82f91d16cdf5c32a3d5c95781a23d9eae6ead9f
MD5 0c3b321c291444ffc8d592341963004b
SHA1 0c4abf8c6e94c277ec3225e56926dd325f861aba
SHA512 9c544d4e5f6761c448bb08841ec3c3588451c4ff87ba42cb04bee7074dcb395e7e2f792f834cf5d857832c645121f753c98df37ac3dc7091d9ce2ca4e58f8734
SSDEEP 24576:m9+EM09rYn5G4t1+qwA9+EM09rYn5G4t1+qw8afDd70iTWCD:U+E7Y5Vwqp+E7Y5VwqeDd79WCD
TLSH
T1E3A57B7437F40C12F2B755B6A9B1D6901C367A350338D2CF7999664E6D23BC0983BBA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 371f4f371715e8f3ea5a5ecea906a74e7d187b77f4b602dc9b9439db02d7261c
MD5 a7799bde28bc627e6a8a9ac5a4a7547b
SHA1 f1096f6d14dc087c1fc3565662d66f3c52178685
SHA512 c5f18d28a542b4756570056ab6c8f02908b68a00bd34595d2f81b0963a08f137cd530204cfdadc3dcb72943b3334e70950671cb846d09e548eeaea5bb4fc21c7
TLSH
T1AC113A29F0F9CC23F53228CF4139D9525CD0336B9C5CAA8A230D411C7B55C328E558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4448-72-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/4696-22-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/4696-35-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/5696-66-0x0000000000E80000-0x0000000000EA1000-memory.dmp

Download

memory/6076-6-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download