9cb280df55793e83091f0b69c6237236e90eda81d406c0e76744deabc5c10fd9

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
Size 6.1MB
Sample260922-xx2dlsdf38
SHA256 9cb280df55793e83091f0b69c6237236e90eda81d406c0e76744deabc5c10fd9
MD5 8457565739b51a4a4981a3c15284347b
SHA1 e3c312a23ec19456358401edc0b324af98c773d5
SHA512 def9f60358625364ed100cc7ed79a79403f52128ae99496777192776c217e2cacaeb004ec05f28617d990a9c9a229db9eb0b9085f3a815746ee4fad941f924a2
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES7+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+W:Kp7V
TLSH
T104565C09F94340B1D92B10B04DDBD3BF8A70BB2587128EE7FA8DDB1B7932BA16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
4576	svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe
1204	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABAABBCBCABCAACAACBACACABAACBBBCABAACAABBCAACACBCCCBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe"	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCBCBCCACCCBCBACBCBABCABCCCBCCACCBCABCBCCACBAAAABACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe"	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1836	sc.exe
2332	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe
3008	cmd.exe
2328	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
4576	svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe
4576	svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
Token: SeDebugPrivilege	2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
Token: SeDebugPrivilege	4576	svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4300	4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe	92
PID 4300 wrote to memory of 4984	4300	cmd.exe	94
PID 2404 wrote to memory of 1744	2404	svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe	95
PID 4968 wrote to memory of 3008	4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe	98
PID 3008 wrote to memory of 1836	3008	cmd.exe	100
PID 4968 wrote to memory of 2328	4968	2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe	101
PID 2328 wrote to memory of 2332	2328	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_8457565739b51a4a4981a3c15284347b_elex_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCCCCCABBBCCBAABBAAAABBCBABABABBBCCCCACAACABCBACBACCBBBCCBABCACACAACCBACBBACBBCBAAACBBAAAAACABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCCCCCABBBCCBAABBAAAABBCBABABABBBCCCCACAACABCBACBACCBBBCCBABCACACAACCBACBBACBBCBAAACBBAAAAACABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe" start= auto displayName= "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe" start= auto displayName= "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABBBCAABBCBBBAAAAAACCCAABABACCBBBCBBABCBBBBCBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCAAABBCBCBACBAAACCCBCCABCBCBBCBCBAACACACAAACCACCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
1⤵
- Executes dropped EXE
PID:1204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e841ae0a5996804db3d125c9d058d12413bd6faccfcb0f3f8bd285d4fec137b1
MD5 caf3d4dd0d8e4f8ef39be01a92beb073
SHA1 2871596c14e7057d6e661dea6f2a860525bce282
SHA512 40de39eebd2c9f20253e51bd167651da80db9d551ab4101663a140fa5dcaf96ce9c4077249e1a150fa8c667d5686d8dd9d33aebf50465d79c06c01bb1ac0d0f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0bc63a097ed3b8b220403e4954808a78c25e2cd8743fc97d9824a71495de601
MD5 39e4ee401415851ae3224a402ffce65b
SHA1 713c766fe9ff40b9a7eb03efe4ac6a9dc90c6747
SHA512 1c52ee0e52ccb06466bcf99cffb8903440080cb8f74b434ac712dde176e318a4ed61bb535bddb8ea6cdbc7b156b1a9f6e2697ee6c3943d0f84887c048653cb26
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3c3412e58dded7a28a79eb3439f8a9e8a0ece683daafb216bfcb06d2ac49f302
MD5 0d69c37c0b8e1357db21fa2ff44c21ad
SHA1 9c73afb12e1aa23568f90fe7aca85d99ed866b37
SHA512 cf948ef19deebd182cbd2bd862287736d104cc68410e4496de03e4e077d996ccf5b62e46e2b17e2a00cd9359f6e50691b17010b434c4525d1a1e9eca9411f8d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fa87d14ed070156785712530d4819b6bd60f5018c3832f4d62ddd64f8227d2f
MD5 24461bd49b8e6baac23cf0ff4e0f6ca5
SHA1 21e525337f6d55916bede9a32ae8569f632028b6
SHA512 e6539375bc5eaa178535001e1dfa5fe7dddada32eca5955a1c6d8ebe32e7b947cea215712547c8540ec46023f32665341d96dad0b2fd0d058d80187d791fbbe8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64d5a077e70292a9a1a2b070b3ddc0318eaf8f82cd371f9b64cc37b0d38f8efd
MD5 953b2167b0529ab8e05af3ab535cd18f
SHA1 b30e836f969dcf76e40b2cdf1f4279335a329472
SHA512 0769f70c5c9fa9dcc7394dcbd8200ae43e93625de9b8d6ae3a8c225be546a5cb6fa0d6d51bf27ceed6d06cef35d11819b8a5770a22d985e83d624a8257408e58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 014a4620def9e03fb97fb9ca54c2837ee08fa50d4a33d859340d183c79546bff
MD5 a5360b61759c0253e2d77a34c723fe27
SHA1 976cfec6014f2c94f10f7c1576fcd7f332761327
SHA512 87c1dcd9edab2cdd611ac2ef2b2cbd485522437c5889f772afbea7abefbb0251a8b8d55f2115ca7881903a02211a15e5384dcdc5029396ed526b1cf01a5e4d86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 58e9bdb03fc42bb1122fa216f9c32a055b9d162fa94895673f82a1714e39146d
MD5 05f161d70fe874a58f70c23a6069883a
SHA1 c7b1c3b07ee47dd2375e76399547954f48e7b709
SHA512 d201e096e9f8fe737525f5b9ff728d3238b9d467ff22394c36360d563ec6f8baa2b0d64788d0f3a47f74345a6c4e8b28fc23f2e4d8b2506ab51ac8da09b20e25
MD5 SHA1 SHA512

Submit Download

svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBAABCABBAAABACBCBCAABBBCAAACCCBAACAACBACCCBABBCCCCCB.exe
Size 6.1MB
SHA256 9cb280df55793e83091f0b69c6237236e90eda81d406c0e76744deabc5c10fd9
MD5 8457565739b51a4a4981a3c15284347b
SHA1 e3c312a23ec19456358401edc0b324af98c773d5
SHA512 def9f60358625364ed100cc7ed79a79403f52128ae99496777192776c217e2cacaeb004ec05f28617d990a9c9a229db9eb0b9085f3a815746ee4fad941f924a2
SSDEEP 49152:U+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES7+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+W:Kp7V
TLSH
T104565C09F94340B1D92B10B04DDBD3BF8A70BB2587128EE7FA8DDB1B7932BA16434655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 40fc455bffa21fe422a753a4051b67040bdcbdb867fb4aa128d10df021279f43
MD5 839c4d304f2748e361bfc8dcd5a2fd57
SHA1 65de0f4cbeb6350aa5baeb9793bb458788575f49
SHA512 85e85dfd40b9893ae5d2590986f2fc8a23862c3d3ff6b3a729e92bef5411e80d3bbbd592416bed94929f0b014abd527844f3f54169f117f97b022b7c7ce7b0a1
TLSH
T14F11C160B0F59867F13A6CFB42659BDB0DA4378F5868AB24130943187F45C358E558F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2404-34-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4576-74-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4968-8-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/4968-0-0x00000000004E0000-0x0000000000501000-memory.dmp

Download