33c96f226c6b25b1027861f282aabdef2bbb97c5144980ef4d710920bdc098e7

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
Size 510KB
Sample260901-28vsescn8v
SHA256 33c96f226c6b25b1027861f282aabdef2bbb97c5144980ef4d710920bdc098e7
MD5 f6dea66ceebba222141bb00078842c70
SHA1 0390e0d002a08d310388ce932e6794916a0fe119
SHA512 7f97e466936f95070108339b69a217d0d1f5abeed8d1e750340523220e23930f65b7f7dbd7c802f7fd787aadf3554b399b469ea2449f83edd5b705866fdef2a6
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAx+ZeDuwLhAmZXuYM:m9+EM0q9+EM0wkohAhYM
TLSH
T174B41809FA4240F1D46609704A96E67E9720BD24C6134EEBB684AEDFFFF2AD05D34631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
2172	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
3372	svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABCABCBCACCBCAABAABBABCCACCABBAABCBBBACCAAAAABBCCCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe"	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBBAACCACCACBABBACAAAAACBCBBACACAABACCBBBABCACCBACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe"	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4804	sc.exe
3156	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1760	cmd.exe
1532	cmd.exe
3284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
3372	svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe
3372	svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
Token: SeDebugPrivilege	5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
Token: SeDebugPrivilege	3372	svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 1760	5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe	92
PID 1760 wrote to memory of 5792	1760	cmd.exe	94
PID 5064 wrote to memory of 1532	5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe	95
PID 1532 wrote to memory of 4804	1532	cmd.exe	97
PID 5064 wrote to memory of 3284	5064	2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe	98
PID 3284 wrote to memory of 3156	3284	cmd.exe	100
PID 5040 wrote to memory of 2084	5040	svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_f6dea66ceebba222141bb00078842c70_elex_icedid_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACABACABBCCABBBCCABCABBCAACBCACBCCCCBBACBBACABBCABBBACBBBAACCABCBBBCCAAABAACBCAACBACACBCAAABBABBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCACABACABBCCABBBCCABCABBCAACBCACBCCCCBBACBBACABBCABBBACBBBAACCABCBBBCCAAABAACBCAACBACACBCAAABBABBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe" start= auto displayName= "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe" start= auto displayName= "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAAAABAAACBBAAACBACBAABABBBCACABACABABBBABCABBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
1⤵
- Executes dropped EXE
PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBCBABBCCABCACABBCBCCBBCCBBABCBBCBBABAACBBBCABABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 51964e64fce9f3cc406ee93d20b4fdc726955d205b958bbb446a11ee57e421f3
MD5 e9a1c22978a090cb2a4b7861d09fc7b3
SHA1 bbf5e0a161f16a82a4f7e35676d8074303ec5eaa
SHA512 c7931ad577e17bb56e6df8206ca54912ebd7476792c24b63a72ef1cc1d793cfb93f2438ce16c71530de3915473d89160b3ce8288b8f578b0f852ebd2a99feb1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9aebde768f646679760854816cea15e852962c09c40519961426eab8c7d40f0e
MD5 2dc36fa8ff724b903e28f28ed6292281
SHA1 28c4ee14f80e24aa16e43b97190f26345ee025dd
SHA512 5afc6f3e8a39e639a1861b5aa35654b6dc0d50632f720c52f5bc3b2c79c6fbc50be5f89ee56f0f1b9db34a4d7ce7a61a24e300db19ae53d1756b3f706ec261a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9d5bfb6d1f78cd71abf015d44b563609b04bf66b27230cd2c88ec9b1d7b262f
MD5 e0ce088db248f021f09199d1b7553a00
SHA1 9c2751ea6548a8b1c1ee1a5ce7560b4b83ae0152
SHA512 8357e6d5f989940f6db4bdb649c5521352df8649e2f1b718b5a675eeb5746a0c1f293b7ce70dd34342dd1fba16d0103ec1e3f261b0fe8a26140a26b3e3daf70d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70fd6bacff3a2505e2988541582a6ae66daef835b2f63538075e19266251b906
MD5 cf4ce2a8d3fded5784405ba6af828ff4
SHA1 8b5bc3f96475b0243fdf522ae6806cb49e9c928f
SHA512 ac7e1c7b492ba276cdb7d6fe762bb34a50cd09bf4f53c54dfe88002852d251a664735877928d3565824161070a1817236853c00ce5b88539ce64af10b7ad7c57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d348b1931dc51addb416bc5dc81b7d21c81f8f44745f0e3d4ed421e87e0bd324
MD5 bb6b21097312a70d0cef4c7632c1b049
SHA1 9e5c0ad5c1f18a3c7ce76d7b27204116223c8c09
SHA512 124a0bcfe2bbc840933c7b9f88daec6a62cc0df89990cf472a6681209c691ff763818e8a545f2640e2674bbfb17bd9d8e1273e0949122030c6ea6a7107f3cf8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c100d728f87b7d568192690389530309dbb48ede665df6e3c0788d8bd1d34e53
MD5 12ee1d47e9d212b79056b88c18e5a099
SHA1 5c87209c05c78c1b718383999264dbe04f1c01ee
SHA512 098277ab3f3bebfd676a5c016b73dc74126dbf73f9ed8a32217bf1b6ab8bdbe27417f15847d34edba7b3e797805895448baad8ef0e5b4df1b774ac63ab9be74d
MD5 SHA1 SHA512

Submit Download

svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBACCBCACCCCBBCBCBCACACCBBCCCABAABBACABCABCAACBACBCAC.exe
Size 510KB
SHA256 33c96f226c6b25b1027861f282aabdef2bbb97c5144980ef4d710920bdc098e7
MD5 f6dea66ceebba222141bb00078842c70
SHA1 0390e0d002a08d310388ce932e6794916a0fe119
SHA512 7f97e466936f95070108339b69a217d0d1f5abeed8d1e750340523220e23930f65b7f7dbd7c802f7fd787aadf3554b399b469ea2449f83edd5b705866fdef2a6
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAx+ZeDuwLhAmZXuYM:m9+EM0q9+EM0wkohAhYM
TLSH
T174B41809FA4240F1D46609704A96E67E9720BD24C6134EEBB684AEDFFFF2AD05D34631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5571a424e4544f4f236d455ead771f422da87be2ec24b3064b750b83c4243a24
MD5 fbc6a9512f61fa4de440eb06ce7464ac
SHA1 096efbb25b25ce5ead799ce74c1befcf61a0aa60
SHA512 961dabeec21e524e64ce92e38d6892bbaf8a0e6273fa6ab92d9ebff36c1acc61664aef1fb33dff8878183908fb7af39b30ddf51a494d12b2024c77fd040e49b3
TLSH
T1D4112321F0B58C13E131E8EB56B9EFE70DA43B975CB8AB04530A01186B89C36DE190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2172-66-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/3372-72-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5040-22-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5040-35-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5064-6-0x0000000000350000-0x0000000000371000-memory.dmp

Download