611fb55678c878cffb81fb084e69a05fa1e148bb6a8e498efca9385679b3a27e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
Size 3.4MB
Sample260828-wrhtms1grf
SHA256 611fb55678c878cffb81fb084e69a05fa1e148bb6a8e498efca9385679b3a27e
MD5 3e528e2fa51af12cc3ed854f221ec241
SHA1 5cdda164a743cc586e07d44ac9159d4b87a28d14
SHA512 290a30b12a76525d57575a5a8b229a171364b4059b737d244bb46ee527879e64953a04750497a22a9851d3021f3c07385a51abf3d1149032a1f0e92db4900c70
SSDEEP 49152:U+EI+E3+E3+EI+E3+E3+EV+EI+E3+E3+EI+E3+E3+EqDd79WCB:pp7P
TLSH
T111F54B04FA86C4A6E97601704C9BC3FAA530BD218F018AEBB6C9B37F5D737D06535A19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
6136	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
4216	svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBCCABBBABBCACCBCABABCCBBCBABCCBCCAACCBACCBCCBBBCBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe"	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCABBAAACCCBCCCCACABCBBBBCBBBBBCCCAACCBCBBCACAABCBACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe"	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2916	sc.exe
2128	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2520	cmd.exe
3172	cmd.exe
3268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
4216	svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe
4216	svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
Token: SeDebugPrivilege	5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
Token: SeDebugPrivilege	4216	svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 2520	5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe	92
PID 2520 wrote to memory of 5856	2520	cmd.exe	94
PID 5536 wrote to memory of 3172	5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe	95
PID 3172 wrote to memory of 2916	3172	cmd.exe	97
PID 5536 wrote to memory of 3268	5536	2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe	98
PID 3268 wrote to memory of 2128	3268	cmd.exe	100
PID 5000 wrote to memory of 1920	5000	svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_3e528e2fa51af12cc3ed854f221ec241_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCBABBBACBACBBAAAACBCBCABCACACCAACCCBBCACBBBABBABABAAABAAAACACCCABABCCCCCBBCBBBACACABAACCCCABCAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABCCBABBBACBACBBAAAACBCBCABCACACCAACCCBBCACBBBABBABABAAABAAAACACCCABABCCCCCBBCBBBACACABAACCCCABCAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe" start= auto displayName= "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe" start= auto displayName= "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACACCCCCCBBBABACCAACCBACACBBCAABCACCBACCCCCBBABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
1⤵
- Executes dropped EXE
PID:6136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCABACACAAACBCBCBCBBACBBABAAABAACBBABCBBAABACBCBACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31cdc891314f51ea8352e3f51c6b70a9227a4f8466129bf64329c75da405224a
MD5 504802c15b9283cf7daa3c18579a65d8
SHA1 eb64f3fca7c8f741e8f5ec8c2acad1253681b91c
SHA512 47bbdcff05862cb518a332e53c1fbbf529daa11651653c8a8a593784fcab11a997e7709b67490518aa069df895f4b157731bedb1c6dfa8d930ae06e74250f82c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d01fb4c85797fa0cf45f5a06b6ea30932270cfb7db1427ea801d8826128b0584
MD5 9bfa0eda06f4f2222c476f9b0a7084cb
SHA1 9fbcff2bb715b8adf0cc24499dca34f9e0e16b8e
SHA512 c49227830727adc07e89ee6fdf2b3fe787a334d5622befc701b191092eb867289298a438383bdc6c855e662f4cf52ef5317a6206f26c0fd2e4094c6e008939fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9fab039369aa5b5d6693af310cdf2e378bd1139d54205807741950b94467795c
MD5 684db14a2e3d0824fd41130f0e64936d
SHA1 532f1b78216205861da3885097952253c69daf9f
SHA512 45e2ef8bdf8d89f1d9884bc31f87762dfe7dbd9c07be133e885f6369b87d12e352a1f50648750a6b0c6cf0322c47e7d392b3474e9c3d63d58b3acead701f7dd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 165fe88b4644aea5af63e4cfaecc88882f009f28a8ab6ea6e493ddb18908b143
MD5 89f50c853b88673e6b2667c5fdee6726
SHA1 88dc59345339c81e2fb696751938318165db8cdc
SHA512 916a7913b4ebe9e835864030f93b8311d1c5f810c7579cf048bdd88b230c0ace5b2e5a5b76e53f641ae8f56b61342add833d0c81f528f2cbce8bccc38211ef68
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b608f4267b872102d99150c15dc65e619d4c0c0cdb5070933b14deef64b53ad
MD5 b490588964ca56aa457268f85344e874
SHA1 0d5f034eb70126ca64301f9108eddfb3e4b26c5e
SHA512 7f63ce36859333dfb22ee53b28649d864e1f5052fa80667ef1fe5e3c9dd942bb90527b11e45c3162bb470747550a258adc1829a8de3682fe5ff4dbe4f566670c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be000c5eaf017ef33dedd4ce0a1e04e8d795307197e9460f5b8e4a2a8168c66c
MD5 5badd3aff5710c4590cc0d625674b343
SHA1 47ed48dbb4928730be7194535ba7264c1c4bd1d7
SHA512 a30e75e6f83b14339813a8b0a60f04d574d3118c87f037943f1c7312a07759e6eefa6154778907a37052278e9057098468c87e2b6d1deb5b7ac9c67fde9b73b7
MD5 SHA1 SHA512

Submit Download

svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBABACBBABCAAABABCBCBBCBBAABABCCAACABABAACBABBCCBCBBCCC.exe
Size 3.4MB
SHA256 611fb55678c878cffb81fb084e69a05fa1e148bb6a8e498efca9385679b3a27e
MD5 3e528e2fa51af12cc3ed854f221ec241
SHA1 5cdda164a743cc586e07d44ac9159d4b87a28d14
SHA512 290a30b12a76525d57575a5a8b229a171364b4059b737d244bb46ee527879e64953a04750497a22a9851d3021f3c07385a51abf3d1149032a1f0e92db4900c70
SSDEEP 49152:U+EI+E3+E3+EI+E3+E3+EV+EI+E3+E3+EI+E3+E3+EqDd79WCB:pp7P
TLSH
T111F54B04FA86C4A6E97601704C9BC3FAA530BD218F018AEBB6C9B37F5D737D06535A19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cc7a8d76ec52fe2144ddfd1454893d6cf6415349093eb02ea64940ad8954aad2
MD5 f64fcc34537437ab3092ab5197d8ff63
SHA1 700c60a1295b67d52ec754439a06e155016f7e3a
SHA512 99e106cb50eeda0417be80cd59ae4d59f10c8dd1dc966273de58ea47cececf5960b167b1f2a9cf0b9b212ae653535d0cd5412a232ad37cd1d737d7ff3f27d6c1
TLSH
T1BB11C151B4F5D893E47224CB82358DC32CE926DF699CAE66230A431CA7E9831DF552F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5000-22-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/5000-36-0x0000000000720000-0x0000000000741000-memory.dmp

Download

memory/5536-6-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/6136-65-0x0000000000720000-0x0000000000741000-memory.dmp

Download