9ecba9069af3f4652f1d5cde0ab77330ddfb2893efb3d4c911accbac990cd6dc

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
Size 3.6MB
Sample260830-3q298abl7s
SHA256 9ecba9069af3f4652f1d5cde0ab77330ddfb2893efb3d4c911accbac990cd6dc
MD5 ff88b3a4e78741488ca34480652adc8b
SHA1 2f0ba652d38ab120cad1905de8fb87fc4d1de8ac
SHA512 463f4793de0dfb9639d6ba1c69a5416cf6623208f0b8cd299723bdd4e7ca321e39140f38d94659df661bac55fcddcceca151dad06541d5772f7711e208857122
SSDEEP 49152:U+EM+ECiw2f+En+EO+EM+ECiw2q+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+k:Cp7V
TLSH
T17B064C09F6DA4475E8B7617049E7C27AC6B1B9518732CADFE244873E1E33BE0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
2540	svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe
1096	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCACBCBCACBACBABABCAAAABABABBABCACCBABAACCCBAACCABABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe"	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAACABBBBBCBBBBAABACBCCCCAAACCCBBBCCBBBBABBBCACACCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe"	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5936	sc.exe
5212	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
2392	cmd.exe
4284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4804	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
2540	svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe
2540	svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
Token: SeDebugPrivilege	3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
Token: SeDebugPrivilege	2540	svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 804 wrote to memory of 4312	804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe	92
PID 4312 wrote to memory of 4804	4312	cmd.exe	94
PID 3516 wrote to memory of 1028	3516	svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe	95
PID 804 wrote to memory of 2392	804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe	98
PID 2392 wrote to memory of 5936	2392	cmd.exe	100
PID 804 wrote to memory of 4284	804	2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe	101
PID 4284 wrote to memory of 5212	4284	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ff88b3a4e78741488ca34480652adc8b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACABBBCCACCAAAABBAAAABCABCCCCCAAAACBBBBBBCCCBBBBAACAACAACCBBAAABBABACABABCBACBBABCABCCCBBACCBACABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBACABBBCCACCAAAABBAAAABCABCCCCCAAAACBBBBBBCCCBBBBAACAACAACCBBAAABBABACABABCBACBBABCABCCCBBACCBACABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe" start= auto displayName= "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe" start= auto displayName= "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACACBCAAAAAAABBCCACAAABBABBABABBBBBCACAAAACBAACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5212

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABBCCACBABCABCCBAABAACBCABBCAAAACCAACCCCACCABBCBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
1⤵
- Executes dropped EXE
PID:1096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c9ee76d09ef9b31e2ca483da94ebb2cec9e3216d989a79bf99d1b69716f4510
MD5 00639bf669edf09dbc126241eccc4d5d
SHA1 e9ddc225f11c9adf798af90ee2f43f2c6b6fee5b
SHA512 c522a3ec5a70d918b02a8a4a411daf253db704afbaab8aee4936f5498305df7cd367b91a5c934afbafd5732ce35b7c4c00279ca0d587821bd53094b54c56d6f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 088a6b0560cc49ee71797b6b2f94b065f059f9318230bac38feec1a354a7b25e
MD5 afcd0371078c56f0d3fc65c1438be8a9
SHA1 8fb0bebf105af5bfcaa99bc6fb31c974e313e351
SHA512 e40abc552c2e62dfa78fc5f204a8dea9f2f44b02770c22ecd8a84b649968ceb8870ab3d956961c6b4eb8dcef1a397e8d413c86fcb72299137be29a54397db713
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 753434a9ac109f41cfdd8002d8c92c807e3c663ce1dbb3819495ca0c95a38d48
MD5 559afecd67af46798401e2bad152a138
SHA1 56d5eb1b6eb1aa7b5b24f22dfaf323e44370dfca
SHA512 b1f6d0335f3fa6d10b0e911ba9c4378273d96e85fc7a69a22bc4131d77321a4fdb5475ad91fdde0d2f9ee23c9afe851af87b812063cfe72b8c9e6f855ada3028
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1372a162771be37c83cbfa61f459de2324c7ad0f36966087115ff4dd379a6980
MD5 a1901e86b15225dce1c770b1b9210e19
SHA1 03dff744ce6d2cbd6ae4568f7e093d79e29b1f88
SHA512 60acef5865bdcaf186da6ecd766e0bda4549d7f5bc99850fc96274121e2ab53add52b75dcac25fadee588dd9f4e85c6837540fa2168628a2bd084c73b97eeb83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e0b805028e4aaefabece7b1693ec99602f3b0aa16ca0139b2ade1076944630cb
MD5 574f0053a7fcde39e441c3ca9c6eb802
SHA1 3fdb714eac1b068aff4cac3081877dc816bfa340
SHA512 39c8c45edf4ae98cbd78df32ce9ab92e9c99d1584132d131fac89848c315f6f5c94454710fa2063bd34f2d1cfadab3043dd9edf6728135eb2cf108a934e82d14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e011b5685ae0565d32cd0b033004a091dd95ad491bd2d463d1a57e3705da7d8a
MD5 57d587e893224aa3ed1b366ec9f26f72
SHA1 40bbe6828074b332e9497feb872761a295103231
SHA512 d0154022a511962a9903d20ba8ae4ba46919a7e3398226cb64481e557527d2219055cf693794556c3993b3e16be459f0dce1b2bbff604822665d8e94a6c9ecdf
MD5 SHA1 SHA512

Submit Download

svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABACAABACCCBBABCCBBCACAACCACCABBACBCBAACABACBCBBABACCA.exe
Size 3.6MB
SHA256 9ecba9069af3f4652f1d5cde0ab77330ddfb2893efb3d4c911accbac990cd6dc
MD5 ff88b3a4e78741488ca34480652adc8b
SHA1 2f0ba652d38ab120cad1905de8fb87fc4d1de8ac
SHA512 463f4793de0dfb9639d6ba1c69a5416cf6623208f0b8cd299723bdd4e7ca321e39140f38d94659df661bac55fcddcceca151dad06541d5772f7711e208857122
SSDEEP 49152:U+EM+ECiw2f+En+EO+EM+ECiw2q+En+EO+EM+ECiw2f+En+EO+EM+ECiw2f+En+k:Cp7V
TLSH
T17B064C09F6DA4475E8B7617049E7C27AC6B1B9518732CADFE244873E1E33BE0A834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 776B
SHA256 d2c6b915b0a883ab0b09407a9760c6b1e85579c81b54a70756434906dd61be40
MD5 219a2f458137b68fec7eb93533e4b1cd
SHA1 434a533e33067a2df3b43f254e8a28c0b1d129e4
SHA512 ececf8838cb241b553b14be4568bf6d20532b51bdb0eba78c9d048ee4a94429385a1444d7155f41762bad5058e30c572ec6ef47a17c38baa9447bd0db3b79688
TLSH
T1F301D270D0F9DCB3E933AC9F96298D870CE436ABEC9C6A4863195218A7448329D158E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/804-0-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/804-7-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/1096-81-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/2540-79-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3516-33-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/3516-23-0x0000000000790000-0x00000000007B1000-memory.dmp

Download