0ded4f72dcc482e0f0f58e407ce717db0a2e988023c267ec9843e229745a666d

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
Size 623KB
Sample260905-dnbxtaswbx
SHA256 0ded4f72dcc482e0f0f58e407ce717db0a2e988023c267ec9843e229745a666d
MD5 9446261b9ae3bb8450c87536d3106cb5
SHA1 aaf92c6091733b2a3269e6af99be0a012059bfea
SHA512 f9cccab3a738b66d38a73d190fb178737a71b0727dcf988e43edb1696c756f66c23463ff86e237943312607e08729f5aa21aad0f7df7ced3cc4c45054bcd165b
SSDEEP 12288:mgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oI7LUeDuUlI2:m9+EM0JafDd70iTWCnUY
TLSH
T1C4D47B1077918035F5B319318ABFD3399638BC314F6586DFA3C8663E9E71AD0A934B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
4412	svchost_ABBABBBAABBABCBAABABCCBAAACBBBACBBBCBCABBACABBCBBCBABAA.exe
5692	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCABACAAAABACABBCABCBACABACACCACABACCABCBCBBACCBABABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe"	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBAABBCBBBACACBCAAAAACBAACACBBBBACCBBAABCBAABCABBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABBBAABBABCBAABABCCBAAACBBBACBBBCBCABBACABBCBBCBABAA.exe"	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3016	sc.exe
1472	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2512	cmd.exe
4308	cmd.exe
4892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABBBAABBABCBAABABCCBAAACBBBACBBBCBCABBACABBCBBCBABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
Token: SeDebugPrivilege	4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 2512	4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe	92
PID 2512 wrote to memory of 3548	2512	cmd.exe	94
PID 4724 wrote to memory of 3868	4724	svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe	95
PID 4952 wrote to memory of 4308	4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe	98
PID 4308 wrote to memory of 3016	4308	cmd.exe	100
PID 4952 wrote to memory of 4892	4952	2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe	101
PID 4892 wrote to memory of 1472	4892	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_9446261b9ae3bb8450c87536d3106cb5_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAABBBCBBACBCBCBABCBCCCCBABCCACACCBCBBBBCCCBBAABBCCBBBBCABBCBAACBAABABCBCAABACBBABCABCACBCCAAACCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCAABBBCBBACBCBCBABCBCCCCBABCCACACCBCBBBBCCCBBAABBCCBBBBCABBCBAACBAABABCBCAABACBBABCABCACBCCAAACCCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe" start= auto displayName= "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe" start= auto displayName= "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAAACCBBBAACCBBACCCAAACBCBBBAAAAAACCBAABBAABBCBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBAABBABCBAABABCCBAAACBBBACBBBCBCABBACABBCBBCBABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABBBAABBABCBAABABCCBAAACBBBACBBBCBCABBACABBCBBCBABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
1⤵
- Executes dropped EXE
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 85a199e3c7893a841f5ae84c3c41212fde4d63727d850ab0797e73e20d886a73
MD5 27cc5c9560f12e0f7206d06d177e7f1e
SHA1 e218f30d896d322a2c952431859426a3c5ef859d
SHA512 5b11d6401b59f10979bc4e9461ba0fb93a0eaf387319b711ec5384529934ce063681b12b74405d1e796e0f0a406ee77d37b0057433b3abd248a6daa9d0e1fff2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33d033b92d007007f155ab0ee01f94351ce7d10fe7aeff939ff85c9a609da35f
MD5 659f4e6960e34996812b5581ca7a4062
SHA1 09ec21b68f6205f2d0886f9295d8d65258d517e5
SHA512 ccddc0083fa297a9b58700f03556f7cbd94559e88dd7007b182a8b8ea4108d46b07624e553ace0f354af32449820d14960d3c97ac74dedea6d9f3f2b07240c8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b41309201c45b3581594f70d95841a425ee141246d6c6b56946091b8ad372874
MD5 debff352d267c163b379bf3307e60a6a
SHA1 258615eddc1779e4400da561ba41c1de6ac110ff
SHA512 775dbc9755dd9db60162cfe5c135ee3341e3fcb4f1dd1d29ef832165dd758626f1d8053cc0030b83eb726004f0d3df6cc578af35ec29a0b86146bbb7cce638c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d35c059d955c92a3bbff18a8842c29a667f3dcad23a542007e153517a839f4d8
MD5 8e7cd784e5d1d29574d8ab6bf3f46cc3
SHA1 759cc0bec81436beb48827f61337b6b70f95bc79
SHA512 fdcd23076cb9b95b92d802d4d093f7595e59040f3564aba4a2b808a51dfa4bbd7e970abce597c63ed984e323991f3b6d019a6ff865cabf1e86bd475b05574daa
MD5 SHA1 SHA512

Submit Download

svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCABBCCCCBBACBCACCCCBBAACABBCCBCBBCCAABBCCABBCBCABA.exe
Size 623KB
SHA256 0ded4f72dcc482e0f0f58e407ce717db0a2e988023c267ec9843e229745a666d
MD5 9446261b9ae3bb8450c87536d3106cb5
SHA1 aaf92c6091733b2a3269e6af99be0a012059bfea
SHA512 f9cccab3a738b66d38a73d190fb178737a71b0727dcf988e43edb1696c756f66c23463ff86e237943312607e08729f5aa21aad0f7df7ced3cc4c45054bcd165b
SSDEEP 12288:mgUFgEsnojA8a0wIk0BX3RKuemGd70ioGuVWW6oI7LUeDuUlI2:m9+EM0JafDd70iTWCnUY
TLSH
T1C4D47B1077918035F5B319318ABFD3399638BC314F6586DFA3C8663E9E71AD0A934B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4724-24-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4724-34-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4952-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4952-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download