0028709130b874c74b6566d704f1a95c6d88f37a9d5da7b1522b06ee5d577836

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Size 24.7MB
Sample260730-by1mtazxex
SHA256 0028709130b874c74b6566d704f1a95c6d88f37a9d5da7b1522b06ee5d577836
MD5 2c3761c512c95b0222cb63bdcd446a43
SHA1 2a149980413cb419a9323d7ec9177374975ce65b
SHA512 f35e5b0c08a66bbbff00f2da4949ebfc52ce36e22b294153f900e17104d63ad3ca5de3d01959ac3df9157e73f8f2f3b493b2b1276a8d495f9299cbb24c8ed2a2
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0MnSunSunSunS+21Bu0FnSunSunSB:a111zXu111zXb111zXu111zXm
TLSH
T15847AF09FD8744F1D92B61B00DDBE3BF8A707A25C4228E7AFB4ECB1B6533B215418656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c5f5-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
2108	svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe
5624	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBAAABAABBAABACACBCCABCBBABCABCABABCBBCCCCABBBCBBCCACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe"	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCAAABABCABCACCBCCBBBCCBBABABCCBAABCABCABBBCCCCCCBBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe"	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5308	sc.exe
5412	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3248	cmd.exe
5672	cmd.exe
5856	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
2108	svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe
2108	svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Token: SeDebugPrivilege	5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
Token: SeDebugPrivilege	2108	svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 3248	4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	91
PID 3248 wrote to memory of 3376	3248	cmd.exe	93
PID 5812 wrote to memory of 5340	5812	svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe	94
PID 4824 wrote to memory of 5672	4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	97
PID 5672 wrote to memory of 5308	5672	cmd.exe	99
PID 4824 wrote to memory of 5856	4824	2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	100
PID 5856 wrote to memory of 5412	5856	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c3761c512c95b0222cb63bdcd446a43_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCACBAABACCCABAABCBBAAABABBBBBAAAABCBACCBBBBCAACAAACBBBCCCBCACAAAABBBBACCBACCCCBBACAABCABCBCBCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCACBAABACCCABAABCBBAAABABBBBBAAAABCBACCBBBBCAACAAACBBBCCCBCACAAAABBBBACCBACCCCBBACAABCABCBCBCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe" start= auto displayName= "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe" start= auto displayName= "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5856
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACAACBCCCAABBBBABBBABBCABABCABBCACBCAABABACCCAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCBACBAAABBABACACAACAACAACBCCBBABCCBBBAAABBBCBACCBBCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
1⤵
- Executes dropped EXE
PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d6a0788b99ffdedb5fbc3bae452592118d2e327245a9c0ce42e3288f46100e8a
MD5 b284c522aa9d16f2f92ecf55d2c0ae32
SHA1 e8bd420eba99ce65ee2b4032dbce0f1aa9d10193
SHA512 44b81137ed57aa1b763e635679718493f30be594b3288a109c324fd97418ca8b709c2e222d081a17067c010726411747acc46f3bf98cc80376d99dd0d72bc922
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0622c83df5687dc0c10655d9be03bed52add932c95a5bc862e2d8d9cb05c0b99
MD5 56d0b09a18a10126b1a753cbdf1f224e
SHA1 c44c53ac106bfba3267db2b2056d959c134a1dd7
SHA512 b1df3f1d9a7f00491ca6fd2736ea9dc256e92d12ec0f52337b064fba91cd0b29088f0616c667826c03cadc4869d03ae5093b61bd2b390eafd7db6aba82cd1969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcfd11d7288e44c8633d4fd3dfcc222b579bf0bd18d3688c907929c74abf5308
MD5 5c5745e925449dc10df04b865f326e3f
SHA1 291d39da37c6732bf844db7ff1743fa2eec15b7b
SHA512 e9ea1661a33823fac95757b241c0aa012bc69c75e6dbebc836df70efa61a11092363155a7388b0a202d64724c738d773132ffbe8df253f675621361edb5b5411
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37787bbe907670fb0a2e32561109bbe6d3fa92a0add1f67487afe306c141db0b
MD5 f952acefe7240b6025b9998196d91e0e
SHA1 9bbe378462180ca3205fb108af9dce4cde52f98e
SHA512 fb339eda1e45fe18c2d22f16705aa02dc4e3f7049a49b03e9d293bb5c12b1659c64c80d2127f815570082dbb0253e5ae26729afeb0ab6470e18864928a52ae90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bb0f7df9d9a9a8e5350cce0385d79ccc4c5d07065bf511a95bcca2654048df09
MD5 d03d39197b144fcf47149407e3adbbba
SHA1 31e185a0c38e87e82a3735adcefc4e00c9f2ae03
SHA512 e913e1b35b11179b01a99a3211db736d73408854fe5d657b08620a066e16b4e034ea7769860a9fd688b2a4eb8baa1bab4786cb95966ec3390d9555e29f12d020
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae6cedf2abc0f16376541a76ae11017edd068ad267854ce688b0ce0cee8d748b
MD5 798a28aad1d4506c5c7fd23e5722c7d7
SHA1 8a415a8102538ede8d11baee411e2febca8f8fd3
SHA512 81cf57a90560e4fb4a7b686aba0ec69607d93b21304d41219f3cb6c2c80add800cd1d90cb294fd5bcabe532fc35344c71175c33412b04e02fe64a2d836f1dd7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c4fc5ec0e84076de34a2faa04a2fe56ae70229b8e9b6c1e860b9b3f3156d8f9f
MD5 828ebbb90dc4767df2a03c9512a79561
SHA1 d412ed5b68eab640213b74b84a38d4b724615aeb
SHA512 c866c9f17f41348a191bf9c64fad0e3507eac0c2577482c528016408b801db2053663bee0b8396646ed1258edeb4be35a90ced662cf0eefd61e4497a7543c67f
MD5 SHA1 SHA512

Submit Download

svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABBBBBABAACCBABAACBCACCACBBBCBCABBABABBBCACAABBAABCAA.exe
Size 24.7MB
SHA256 0028709130b874c74b6566d704f1a95c6d88f37a9d5da7b1522b06ee5d577836
MD5 2c3761c512c95b0222cb63bdcd446a43
SHA1 2a149980413cb419a9323d7ec9177374975ce65b
SHA512 f35e5b0c08a66bbbff00f2da4949ebfc52ce36e22b294153f900e17104d63ad3ca5de3d01959ac3df9157e73f8f2f3b493b2b1276a8d495f9299cbb24c8ed2a2
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0MnSunSunSunS+21Bu0FnSunSunSB:a111zXu111zXb111zXu111zXm
TLSH
T15847AF09FD8744F1D92B61B00DDBE3BF8A707A25C4228E7AFB4ECB1B6533B215418656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 cde902d17eca3cfd83bc8d3be9bef9091ef1f0e1a7f56f94d267d6219f3724e7
MD5 ce9ca7d63754d52c545a99af14b84db7
SHA1 a2b4cbce6e5a527ddd038bab4c902ed306f5dc66
SHA512 c404c5ff540c3d4e97bc9e87fa2cb23caaec988f14d28814b3a8aa4a44e020bb6ad3a20543a68e90f747e0c1640bf1db8b2425a6af1d9d30f143e025a28a5590
TLSH
T12411C141A0A5DCF7E23268C7DB229AC68CF0778B7C58AA54631D8618B789C33DD1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2108-79-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download

memory/4824-0-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4824-8-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/5812-34-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download