be00c5da1daf7f6c772145a9655e0c4a5a3371bdf104ee58593634422f6ae797

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
Size 4.8MB
Sample260830-18hbnadf39
SHA256 be00c5da1daf7f6c772145a9655e0c4a5a3371bdf104ee58593634422f6ae797
MD5 05d9978829427c90c1a1a1f48fff9e43
SHA1 b487ead203ab93ee234de8c64e5315a047d15356
SHA512 53e86a147bb1f17c8b5a2a38cb8420c7ed9dd7375e28ee84ac73c25e67f3bc32f21be784ed9bc82ae65f3f3ccb9765b23a7963edb24fc27e807139d72b4d1f4d
SSDEEP 49152:U+E2/+EDiw2J+E2/+EDiw2J+E2/+EDiw2J+E2/+EDiw2f+E2/+EDiw2J+E2/+EDa:Rp7s
TLSH
T10E363B09B7ED04A4F5B7713049B68679DAB2B8615B31C7DF9284823E0E73BD0AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
5060	svchost_ABCBBCBACBBCAABCCBCABABCBCBBABACCBACACCCABCBCCCAACBCCAC.exe
3320	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBAACCAACAAAAACBCBAAABCABCACAACBBCAABBCBAAACCBCCAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe"	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBCBCBABABCAABCBCCCBABACCBCBCCBBCAAAABAACCCBACBAAACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBCBACBBCAABCCBCABABCBCBBABACCBACACCCABCBCCCAACBCCAC.exe"	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2528	sc.exe
5260	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe
5708	cmd.exe
3636	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBCBACBBCAABCCBCABABCBCBBABACCBACACCCABCBCCCAACBCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
Token: SeDebugPrivilege	1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5424	2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe	93
PID 5424 wrote to memory of 4476	5424	cmd.exe	95
PID 1060 wrote to memory of 3040	1060	svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe	96
PID 2660 wrote to memory of 5708	2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe	99
PID 5708 wrote to memory of 5260	5708	cmd.exe	101
PID 2660 wrote to memory of 3636	2660	2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe	102
PID 3636 wrote to memory of 2528	3636	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_05d9978829427c90c1a1a1f48fff9e43_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBAABAACBBBBBCAABAAABBBBBACACACAAAABCBAACCCBACAACCCACBBBBCACBBACBBBBAABBCABCCBBBACCCBBBBBBABBBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBBAABAACBBBBBCAABAAABBBBBACACACAAAABCBAACCCBACAACCCACBBBBCACBBACBBBBAABBCABCCBBBACCCBBBBBBABBBAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe" start= auto displayName= "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe" start= auto displayName= "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACACCAAAAACACCACBBAABBABABACABCCABCBABBCACAACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBACBBCAABCCBCABABCBCBBABACCBACACCCABCBCCCAACBCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBCBACBBCAABCCBCABABCBCBBABACCBACACCCABCBCCCAACBCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
1⤵
- Executes dropped EXE
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7df4d501978d3590efbe5d425984cd53db99124a0e00e6217626d7d620dcdf92
MD5 471e8302d2d3403d6f75c58a7f8c271e
SHA1 2b7c7abf1f61f33ff2c783731731b24ae11a095a
SHA512 300181568489fa981b2fc42c048b54f7340c7c280f1b25294fa4c64dd449cf72ac024a542596119b40838ed716f1c21e186b86a6e4b5dab698b9f816a26b9235
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28b60ddb58fbd63ac40887b189c28222c23808f4d4cf2dc82de7cadcb3957780
MD5 2331c86362876050f4a216b9e666cac8
SHA1 af8741ab96e212a2e7a0ce2c5fd6eec7587a7f6d
SHA512 fd3e3fc19c8b50ffa6be1ac06d8527aa520494fd2c3b50eec9dc562411a30efeb9afcee2eff95da6f889833a1459d6b6cd5d9b22b457398df3937bee8c136a83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 44281620831982a24451255aee78e9a9e37da21ae39adff740b515965d96b498
MD5 f674268a54bf7a1ab5aa36e19c2c46bb
SHA1 30b86dfd3a51247149684c1125e8e68abc91d698
SHA512 3bce372cca84a8b6f0bf0d7f29f5a68458f75d95f9df7b3a804c70e6459df0e4b4b74120d55abd7b813be5d086b6c2b6e0ac91c7445cb94aa3238baed38230f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0b1d24383ef149d9ded6f6f8dd41975ea4d5d2d42bd1a0a1fce0ac85b8be5370
MD5 dc00693b6ed0f8a570f5ebcff3cb63e8
SHA1 90eaa49e742042a8fa975d5f5687b5373cba493b
SHA512 ad3fa1a44a4dbdf76b233daf6cbf7c8517fe02dce922579943f22763f1fa10b302c8293a86f18aae6c1e5bd45de4fea584f505da2032a21158a8022464c4fd03
MD5 SHA1 SHA512

Submit Download

svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBBBCCCBBACAABCBBCCCCCCCCCBACBABACACBBACCACCAACBBCCAB.exe
Size 4.8MB
SHA256 be00c5da1daf7f6c772145a9655e0c4a5a3371bdf104ee58593634422f6ae797
MD5 05d9978829427c90c1a1a1f48fff9e43
SHA1 b487ead203ab93ee234de8c64e5315a047d15356
SHA512 53e86a147bb1f17c8b5a2a38cb8420c7ed9dd7375e28ee84ac73c25e67f3bc32f21be784ed9bc82ae65f3f3ccb9765b23a7963edb24fc27e807139d72b4d1f4d
SSDEEP 49152:U+E2/+EDiw2J+E2/+EDiw2J+E2/+EDiw2J+E2/+EDiw2f+E2/+EDiw2J+E2/+EDa:Rp7s
TLSH
T10E363B09B7ED04A4F5B7713049B68679DAB2B8615B31C7DF9284823E0E73BD0AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1060-24-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/1060-34-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2660-0-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/2660-8-0x0000000000210000-0x0000000000231000-memory.dmp

Download