4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Size 13.3MB
Sample260730-dclymsxhjh
SHA256 4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157
MD5 d2b823c004ea8df65619fcfb655e8ca5
SHA1 b192a73dae780bd6c860f850ac21e6e840a42d11
SHA512 df6f496ddbb7b3b78606f0f8ed112a409b9698df23493ea271824d0a9e1034a2ee9d25dadef8b2d9abe0ee55b31197ad8eba296bfda7cb8283c26ae27167a9eb
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsx:a111zXu111zXG
TLSH
T17CE6B009FD8744F1D92761B00CDBE3BF8A707A25C5228DAAFB4DCB1B6933B615428356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024534-21.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
3896	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
1956	svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBBCBBBBCBABABCACCBAAABBABAAAAACACACCAAACCACCAACCCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe"	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBACBBACCBABBBCBABCBACBBBCCCCAABCAAACBCABCCBBBCCBABCBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe"	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3080	sc.exe
4812	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1348	cmd.exe
3344	cmd.exe
5080	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
1956	svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe
1956	svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Token: SeDebugPrivilege	5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
Token: SeDebugPrivilege	1956	svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 1348	4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	94
PID 1348 wrote to memory of 3956	1348	cmd.exe	96
PID 4232 wrote to memory of 3344	4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	98
PID 3344 wrote to memory of 4812	3344	cmd.exe	100
PID 4232 wrote to memory of 5080	4232	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	101
PID 5080 wrote to memory of 3080	5080	cmd.exe	103
PID 5000 wrote to memory of 404	5000	svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe	105
PID 404 wrote to memory of 2400	404	notepad.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBACABCAAABCCABACCBBCABAABCABCABCBACBCBCABAAAABBBBABBBBBCBBCCCCBCCAAAAACCAABBCCACACABAACCACABACCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBACABCAAABCCABACCBBCABAABCABCABCBACBCBCABAAAABBBBABBBBBCBBCCCCBCCAAAAACCAABBCCACACABAACCACABACCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe" start= auto displayName= "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe" start= auto displayName= "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBABAAACCCABCABBBCABCABCBCACACBAAAABAAABCBBBBACACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3080

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
1⤵
- Executes dropped EXE
PID:3896

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABACABACCCBACABACAACABACBABAACBBCBCCBACAAACCBCCCAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa90debe3648831645670ab96c11a1145d5ea15dcffa2818139b692bac41f63e
MD5 4b19cec3d33acc26594e680abaaa4a90
SHA1 f1d0d112fbf8f6c7612f3fb7dbc61bfdda9ad7b6
SHA512 073dc283f1573ca1746ac8d95d623c3136c732d6e316b968212dd2bc1532b0553f2f5b283b7185892be153ddd274bf0dc6eae35addbb345550331fe68faed1ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9005e91f44d90b700d0e738c298038e8d886658f65299669ccf32f9d2a47cde8
MD5 6ba92cf788f2db3a43b07dfb3d323e9a
SHA1 9d2277690722606176d0e690c5ed5ab96ff31a9a
SHA512 4831f33c7a97287908bfd3657cec1a3335595e22e8064c4f07bb4e3a63b13763cfdd678b44fe01e80e8347d78f9c3b027163217b9671c861629dd386059c5c8c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7620342c55192c1abf42b69dcc682ae67496ac22ef1810dd50b8ad3c52e04ab7
MD5 e01605991e639838c707f2c99480cd4e
SHA1 25659effb65574dedd5b773ae2ba5a716a011c1c
SHA512 5b0635d6e418a2a0efcf3e12a117a4db883806e6a94fd34ffb69e8e92326e147e4b573abdd58614d93d37d2510596df1d1f464824d23916f03ef6c05f8101958
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d1841aae3f67f46c1793980ad92f1332c3062a040f3b9c0e9b83ec0f5d2797a
MD5 fdedf96eed3d110b2b83115c43ad3ec2
SHA1 a9b5c7a94b2ca72fdb131347369c9132552fa475
SHA512 e6c16eb9f3bcd9821cf6dcbc5fce964f10b3ddc4eb1c87618c10aaaba2b42d803a85550cc487b1582d96e974b1801e3d2468f609091449d78b3ccb8c2b536a85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df438b6dae99e6c4d41e62459d4d752d8f470d942b912eb733eecf6e531b96f5
MD5 f0871d36bed43508e63ff4dfaccb1990
SHA1 15c7a0e4dc7be7219c9ecc469a4a70217adaaf4c
SHA512 dd02be76b25bcbd846110512f92cc017e796709786b8e4b91fb213aeb8011eced9cdc3376c752b09890d2fda0a3defc13cf7fe1461bb8299798afbd7c1c95cb9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 febae7887a89d9a27b80a82bfe00093dba286f94e2a2626c2e18f468680e998f
MD5 de4963ec679193fd8bc65c085396a365
SHA1 0a69b39ff00fa087a2297b99ff5746ec68374137
SHA512 1be3578902b1c0730cb8803d7f51b6e5bc342d1fa6ade9c7c99b2c6d827ef47db7a13a921d907a107f8cd98a4d68c0fef3069eab4a0406c1bf427e94366b06af
MD5 SHA1 SHA512

Submit Download

svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCBBAABABBCCAAAABBCCCACACCBABBBCBACCCACCCABCCACBACCC.exe
Size 13.3MB
SHA256 4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157
MD5 d2b823c004ea8df65619fcfb655e8ca5
SHA1 b192a73dae780bd6c860f850ac21e6e840a42d11
SHA512 df6f496ddbb7b3b78606f0f8ed112a409b9698df23493ea271824d0a9e1034a2ee9d25dadef8b2d9abe0ee55b31197ad8eba296bfda7cb8283c26ae27167a9eb
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsx:a111zXu111zXG
TLSH
T17CE6B009FD8744F1D92761B00CDBE3BF8A707A25C5228DAAFB4DCB1B6933B615428356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 8c0cf91ed7f06e41687492e73dc374dc8fb9e9f9ee423cc50f9753383fa78e5c
MD5 acb7a0d9ee5e7d4ab0af505bdc721b95
SHA1 012a77f13b08f765979969ed46672a93cb410c47
SHA512 85c2b85c6efece19130661fbfbd17532dc991bb999b85b0425c9f6a78cea301a5a14ac75a576afc81bb2bcfceda51c807ac5e6dbb3b7dd47ace79ae2f9cbc2e3
TLSH
T139014910B0B5D863E131AACB86197B4A8CE6765FB8585B182398870C6B10C33CD194DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/404-67-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/3896-75-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/4232-0-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/4232-7-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5000-39-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/5000-26-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download