03588318bcad4c78a00c350d461539901ff0a084cd3cf708a5ba0bc12e827218

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
Size 15.2MB
Sample260910-dsqa1aej81
SHA256 03588318bcad4c78a00c350d461539901ff0a084cd3cf708a5ba0bc12e827218
MD5 b586c68e48e3f00a481a3985b2c52773
SHA1 1de6bf5284b659f87784f597965224a6ccd067d4
SHA512 9f1de6f990d4d455e9636a9caf9ced4272e1d38b78307a278bb53432028ad334b6d645a698e1d55b3be840fa9933fe83796fec5c8ed76a870b3274a4dfcbd539
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLD:J1/tr37wF1/tr37wVp7+
TLSH
T198F68D05FA5680B0C42B80B04D9BD6BBDA707D1D87219DEBE689DB2B2F337E15938711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
4864	svchost_ACABBAABCCABAABAAACBBAAAACBACACCAAABACBCCBBAACBCBBBACCC.exe
3140	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBACCBCAAACCCACACACBCCAAAACCCBABCBBABACCCACAAAABCABBAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe"	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBCCACBBACAABBBCBCCCCCAACCABBBACACABBAAAAAABCBBCCCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBAABCCABAABAAACBBAAAACBACACCAAABACBCCBBAACBCBBBACCC.exe"	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2892	sc.exe
1708	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
936	cmd.exe
1428	cmd.exe
3960	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBAABCCABAABAAACBBAAAACBACACCAAABACBCCBBAACBCBBBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
Token: SeDebugPrivilege	3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4956	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 936	2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe	103
PID 936 wrote to memory of 2172	936	cmd.exe	105
PID 3204 wrote to memory of 4768	3204	svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe	106
PID 4768 wrote to memory of 1780	4768	notepad.exe	107
PID 2752 wrote to memory of 1428	2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe	111
PID 1428 wrote to memory of 2892	1428	cmd.exe	113
PID 2752 wrote to memory of 3960	2752	2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe	114
PID 3960 wrote to memory of 1708	3960	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_b586c68e48e3f00a481a3985b2c52773_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAABBBBBCCCCABCCBABCABBBACBCCAABBBACABCBABACAACBAABCAAABCBCABABCBACABACBABBCBBBACABCBCCBBABACACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBAABBBBBCCCCABCCBABCABBBACBCCAABBBACABCBABACAACBAABCAAABCBCABABCBACABACBABBCBBBACABCBCCBBABACACAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe" start= auto displayName= "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe" start= auto displayName= "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBBBBBBBBCCBBCBCBABAAACCABBCACCBABACCBCCBCBBCCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAABCCABAABAAACBBAAAACBACACCAAABACBCCBBAACBCBBBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBAABCCABAABAAACBBAAAACBACACCAAABACBCCBBAACBCBBBACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
1⤵
- Executes dropped EXE
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f93c9c8cfa02208d20a47255d709c864fb92f4d69af9b222f41fa2cf40ad5598
MD5 847156e0164f26fd1f7e46a8b3b7f67e
SHA1 d2a730031be35adf9e5ad04bae10e57367b4a742
SHA512 5fcec9253cc7384d4bc89c7b1ded7fd25ac14a7ad2e6188873b1894d66a410d1238f9d5b292db58202071f8a0185669ac49d3fd427f1fa8a51c9006ce0579bf6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e040852d52d770da33a45d4512cc656f355f72c5af458dba676fcb25a4993a1c
MD5 20413a147f0d3732d339c298e1e4aaea
SHA1 5b111a6f62ef7136545592221228a1bdfc2f5dcd
SHA512 5b745357517ab538c49f33df5e4a1b88ef90260dd3d017253bc4f26336e9af53e6dc5160953e0b3d362cbc1338c8df95dfd6298ebdfa2a1403301c67881a75e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 588f57864c9309e3e700a7471c1b5b1c7f2c05c11f16d2675a72dcd9d315265a
MD5 66e7ba792a4d47c0ffc9e4b03b2b1652
SHA1 14591af4f8a01ae61440fb515f8e8d58601c911d
SHA512 9d44da1239580bb9759967f40ab640e1bdcd35dd93c0510332edca9f43e1985819735e2a262983ad642972b6fabf7e5ad7e5c7c20230b896e94a6aec40e730bc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7e063a10da36b1fe0d69bc59897c8d2974abc83b859eebe9fca71facf0624f6a
MD5 517389692baf9d7a90706fb9d17d6af4
SHA1 f6902efce751da6a534e3a1561f435a2bcd3fe1c
SHA512 a287968bada07bba5855556935a2c6d1af942aff5564688a23bdd65954116d26b3a154e0a4452128b4c18bcccac45e1ec1a4b77432ceee4b4b23648fc5661e88
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 36e1b9164cd06a145b20a1f665c216d69ace35d3da44034ba4efb30b53658e3f
MD5 a2417b23f19902cded6834b7280f16b1
SHA1 13825a72002c41ffb95e2b30062bfdd05d41f519
SHA512 dea75bdb67c6a28f4b506170aa41ef53983bae7a64cf3ff778b5c1bc7cb9690067023a8787f92466ea61b62e750ce90d6e76b4af94dc252f1f5ac76101cd744d
MD5 SHA1 SHA512

Submit Download

svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACBBBACABBCACABBACAABBACACBABCBBBCCACABBBCACBCABAAC.exe
Size 15.2MB
SHA256 03588318bcad4c78a00c350d461539901ff0a084cd3cf708a5ba0bc12e827218
MD5 b586c68e48e3f00a481a3985b2c52773
SHA1 1de6bf5284b659f87784f597965224a6ccd067d4
SHA512 9f1de6f990d4d455e9636a9caf9ced4272e1d38b78307a278bb53432028ad334b6d645a698e1d55b3be840fa9933fe83796fec5c8ed76a870b3274a4dfcbd539
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLD:J1/tr37wF1/tr37wVp7+
TLSH
T198F68D05FA5680B0C42B80B04D9BD6BBDA707D1D87219DEBE689DB2B2F337E15938711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-12-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2752-25-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2752-0-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2752-51-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/2752-75-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3204-37-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/3204-76-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/3204-52-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/4768-78-0x0000000002D40000-0x0000000002D41000-memory.dmp

Download

memory/4864-101-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download