982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Size 1.7MB
Sample260905-s528navscx
SHA256 982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482
MD5 2a76f62ab71b2136f62f51158b26ba4d
SHA1 51b471e1d612f6ff30d2bd2787c605ca3588fdce
SHA512 a64ba7ac1d3fc0cc6e4566078d758451cd7118b8c3197e383b302d25ca39066f8dfd3889a6c09c2aa6c5161b9f788c888e947c6024ae4520c4fb0d3638477132
SSDEEP 49152:U+En+En+En+EmhO6+En+En+En+EmhOrDd79WCs:ficp7m
TLSH
T1AE857D08F69640B5E977557089AFC27A8931B9314721CADFE7C8C63E9D33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1152	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
2072	svchost_BCBBBBABBBBABABAAABCCBABCABBCACAACCCCCABCCABCABAAAAABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBAACACCABBCCACCACBACBBACCBBBBBCCCCABCAACABBCAACBBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBBBABBBBABABAAABCCBABCABBCACAACCCCCABCCABCABAAAAABBC.exe"	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACCBCABBACCCBABCCCAABCCCABAABBBABCAACACACACACCBCCABCBCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe"	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
928	sc.exe
4152	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3336	cmd.exe
4168	cmd.exe
1676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBBBABBBBABABAAABCCBABCABBCACAACCCCCABCCABCABAAAAABBC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Token: SeDebugPrivilege	1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5036	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 4168	1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	97
PID 4168 wrote to memory of 4792	4168	cmd.exe	99
PID 1600 wrote to memory of 1676	1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	100
PID 1676 wrote to memory of 928	1676	cmd.exe	102
PID 1600 wrote to memory of 3336	1600	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	103
PID 3336 wrote to memory of 4152	3336	cmd.exe	105
PID 1256 wrote to memory of 2456	1256	svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe	107
PID 2456 wrote to memory of 4268	2456	notepad.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACBBAABAABBCCCACCCACAABBCCCBACACCBBCCAACBBBBCCCAABBBABBCBABABBCCACAAAABBABCBBCBABACBCBCCBCBCCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBCACBBAABAABBCCCACCCACAABBCCCBACACCBBCCAACBBBBCCCAABBBABBCBABABBCCACAAAABBABCBBCBABACBCBCCBCBCCCCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe" start= auto displayName= "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe" start= auto displayName= "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABAABCAABAAACACCBCCCBCCBBBCCBBCBABACAABACACACACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
1⤵
- Executes dropped EXE
PID:1152

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBABBBBABABAAABCCBABCABBCACAACCCCCABCCABCABAAAAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBBBABBBBABABAAABCCBABCABBCACAACCCCCABCCABCABAAAAABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6bec128a338b972159f76e80155ab5b5dafc2dd8946ffd19f3aa24444bab6e47
MD5 170e2e1f5d18cd399a469e8e2bcf1b42
SHA1 0077c6443682189d16f66d2eab196fc73b9b17d7
SHA512 a95f3c72cb999fafbb00155c16011fce97d6e5494ed5ff6a12a525273a626de848cdab7622ddefb871dc3e493cdbe5bed0aeab961751e7282045a2ac578eec4c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e42e8b3f1182e9a3dff1605ac77228f8dab2aa8620c92b85b10b6bc98364fd5
MD5 4e43f4558aadec79b3ad03aa618fd20d
SHA1 3ac63f7b357648e40e993b83fdb92645b9c276af
SHA512 17d45481ab3b7968c2a2763a45e29f195ac465f301b92c894fa1641beeaf90eff38a5a40f1f0553401f9d594bae1dbf0b06184c9ffe9a329ebcc119b39f4f23a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d48411f0f0545505efe81ebb333bcc4d0b8a12f3b96078b64d3bd1ddd4de0253
MD5 9bdfae8722440383b89edd8c56c2f81a
SHA1 1dcad2e0181f9bd66fc9e3527971d12cb525f6df
SHA512 b1267e1c46eb9c5ed793d428e3ee9c5d3555860193e4589f758d6c05e7c865e6fad1c2b7fb09b41cdac7f2865e108cd9b5eac87a237be6310ab139d94786df01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8dd68f363235ac88a5d7588a5e3b4b6bbf78137343802cbf9372dd738009b11a
MD5 84aa50905188b571bf8e059d2df8deef
SHA1 723667d90fde936b792954180546e2e8945048dd
SHA512 5181fca3f1979359a36e463045bf13baf0d8057340353f92f4d2b3c1142ce1feae322015eb46554782fefd59efc950d3e623f33c1c6a20d677ce36c3b7e973dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 10f3f9a23c21a2c31203fd8fe9dad1cc3545a814bbe41da5d0b6af8dc080d946
MD5 3e46407d2f3ac8789f4495e5af258b6c
SHA1 3a3cb21935fe9ddcded109ad13a04a76a255ea6e
SHA512 bb267a82d2ed44f857a5e11845add37aa8c8463286795a6798fca851dfa02f430f5d49887377af33ef5421eb29b8af40a4a4de639aa35c4986233d8c6cdc0f7f
MD5 SHA1 SHA512

Submit Download

svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBACBCAAACCAABBCACABBAABAABABBCCACBBCAAABABABCCABBABC.exe
Size 1.7MB
SHA256 982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482
MD5 2a76f62ab71b2136f62f51158b26ba4d
SHA1 51b471e1d612f6ff30d2bd2787c605ca3588fdce
SHA512 a64ba7ac1d3fc0cc6e4566078d758451cd7118b8c3197e383b302d25ca39066f8dfd3889a6c09c2aa6c5161b9f788c888e947c6024ae4520c4fb0d3638477132
SSDEEP 49152:U+En+En+En+EmhO6+En+En+En+EmhOrDd79WCs:ficp7m
TLSH
T1AE857D08F69640B5E977557089AFC27A8931B9314721CADFE7C8C63E9D33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-72-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1256-25-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1256-38-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/1600-6-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2456-67-0x0000000000C90000-0x0000000000C91000-memory.dmp

Download