982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482

Analysis

max time kernel
149s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Size 1.7MB
Sample260905-s528navscx
SHA256 982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482
MD5 2a76f62ab71b2136f62f51158b26ba4d
SHA1 51b471e1d612f6ff30d2bd2787c605ca3588fdce
SHA512 a64ba7ac1d3fc0cc6e4566078d758451cd7118b8c3197e383b302d25ca39066f8dfd3889a6c09c2aa6c5161b9f788c888e947c6024ae4520c4fb0d3638477132
SSDEEP 49152:U+En+En+En+EmhO6+En+En+En+EmhOrDd79WCs:ficp7m
TLSH
T1AE857D08F69640B5E977557089AFC27A8931B9314721CADFE7C8C63E9D33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
5840	svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe
5024	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBAABBABBCCBAAAACACBCBAAABAABAABBBBABCCCCBBBCCBBAAABCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe"	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACABABCBBABCACCAABCABACBCCAABCCBBBCCABCBAAACABABBACABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe"	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2792	sc.exe
4340	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4976	cmd.exe
4580	cmd.exe
4564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
5840	svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe
5840	svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
Token: SeDebugPrivilege	5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
Token: SeDebugPrivilege	5840	svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 4976	4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	92
PID 4976 wrote to memory of 4436	4976	cmd.exe	94
PID 5984 wrote to memory of 3940	5984	svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe	95
PID 4076 wrote to memory of 4580	4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	98
PID 4580 wrote to memory of 2792	4580	cmd.exe	100
PID 4076 wrote to memory of 4564	4076	2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe	101
PID 4564 wrote to memory of 4340	4564	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2a76f62ab71b2136f62f51158b26ba4d_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBCBBBBCBCCAAACCBAAAACACCBAACBBCACBABCAABAAAACCAABCBBBCBBABCBBCCBAAAACAACCBCAACABBBBAACBBBABACCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCCBCBBBBCBCCAAACCBAAAACACCBAACBBCACBABCAABAAAACCAABCBBBCBBABCBBCCBAAAACAACCBCAACABBBBAACBBBABACCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe" start= auto displayName= "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe" start= auto displayName= "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAACBACBCCBBBCCBCABBBCACCBBAACABBBABACBBACAAAAAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5984
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCAACBBACAACACABACCCCBACBAAACABCAABBCCCCABBBBBACCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
1⤵
- Executes dropped EXE
PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b73a0a659f6da5abd27ee5384fe713e81700f8417ee69cbd5db98191ae17b2b
MD5 c642963f933b606baf65047c0616d241
SHA1 ec21c721ca39fdda083d8eff1ae74c8ed92c5f21
SHA512 2d98a0f33d893b854946fe7150a09475a846d0c9ae509ece436816cdb335ad7acf807d8486aca98dcde02293f2c39361d6284f00cc722a0d0ec9f0782f544d22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41da2599e84d96dd0cd7773a5865a620bff7c8ae02697527e0dece01ae86320a
MD5 e3df451fc4e5e542693e19747f21f3dd
SHA1 d78cf04ddd23a519284938e6602dcdf4d17c71dd
SHA512 9ba500b43640675a36bc0449c145b08406d4e87b2194cc0880c55ff1691064ce1a02648722d7e71cc568cd49e519e44742475e3813a829c429fc22c2b21c1800
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8e0ec71148aea177c28030b31de75968ec6beee33a39d35df251e1433671e1c8
MD5 b3570897c7862e53d6c8109d8fae6cf8
SHA1 abcb1b4b683af709b6e91cb0568d8a1e7d82d0f8
SHA512 70e3f1ca2b532ef5e2bb5e7d1ac85c875b08edd62b286af5c3b0b58f764c8c07d4dc1f2c500252964ad17ee5f09c8271edc26bd1c854394107c4f56b83bc6e2e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 115dccfa3de3f640f8ec18d74c6562b0f41240d6c78acbd56e096e8a1dd25cbe
MD5 02a480d5036eecd74b139fec53eaa411
SHA1 f492e388d2bf60fdf4cd06950e44e0a27c0aca0d
SHA512 ac721f57a21bf517907e526dd30204d6e1a7fa34196dd2a8a7b56b6eb7201cc4c08360a17c073eba65d227aeaeb5017bf37703cc63ff09b415a888ae5ff24b7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d27e1ed74b3bb0de4710ef05e8b925538f9d562fe90625d1dc61353b50e8b499
MD5 42618c2582492ff703720011fdf9b01a
SHA1 701d800d720081c75405e739d9de461da04ce234
SHA512 455f82d6605fbbffad13cfd8c813aadbc442f42e6cbbfd1ca7cfd9133458173a676ffb0e139d77a8830d454fa4baf257b1398f997ce3042ebec52ada3151e86c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 aa093a73ce4033010858b53ced6bd3f3ce0f3ca57e8982869c47af960ae7f93e
MD5 89480cb524d39daeb1c41c8e5db79299
SHA1 40db3ae70acd7aaa7794b073f978e70b7ebf0bd2
SHA512 7b9aeacb9cb4ebc1d937b19bdca7b9f0b11d312e886c0363d69395685cbf9fb7bcdbfb245ca565aa5c5214fba1157d8a6f08b099f4de32f24b8836a5b9a64ad7
MD5 SHA1 SHA512

Submit Download

svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCABABCCABCBCCBBCCBCBCCBBABCBBCCCCCBBABCBCAABBCBCCBC.exe
Size 1.7MB
SHA256 982f4aba9948710e134476c20f1d49dece3ee0cc0e3ab6068f33187350e06482
MD5 2a76f62ab71b2136f62f51158b26ba4d
SHA1 51b471e1d612f6ff30d2bd2787c605ca3588fdce
SHA512 a64ba7ac1d3fc0cc6e4566078d758451cd7118b8c3197e383b302d25ca39066f8dfd3889a6c09c2aa6c5161b9f788c888e947c6024ae4520c4fb0d3638477132
SSDEEP 49152:U+En+En+En+EmhO6+En+En+En+EmhOrDd79WCs:ficp7m
TLSH
T1AE857D08F69640B5E977557089AFC27A8931B9314721CADFE7C8C63E9D33BD0A934B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c6dd8d69a8866a27e33b7497e74c753cf077bf517f4c382160e093331529f067
MD5 e239fb3f2407c0f75b0bfcfb82136002
SHA1 827486aa53715a9dd9a2334fb2250959c4d3d50f
SHA512 dcced9aa07f79c9e1b200266b8c41158c68265a4462974cf06d01bbac74cc093ac5ef5798f9442d2e39c671138c59587e3e60d616f15191ed40150aca9cf6ae8
TLSH
T1F7113621F0B6C887F13138E79A35DF8709E43B9BAC14AB14230C461C7765C36AE564DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4076-0-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/4076-7-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/5840-79-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/5984-33-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/5984-23-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download