4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Size 13.3MB
Sample260730-dclymsxhjh
SHA256 4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157
MD5 d2b823c004ea8df65619fcfb655e8ca5
SHA1 b192a73dae780bd6c860f850ac21e6e840a42d11
SHA512 df6f496ddbb7b3b78606f0f8ed112a409b9698df23493ea271824d0a9e1034a2ee9d25dadef8b2d9abe0ee55b31197ad8eba296bfda7cb8283c26ae27167a9eb
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsx:a111zXu111zXG
TLSH
T17CE6B009FD8744F1D92761B00CDBE3BF8A707A25C5228DAAFB4DCB1B6933B615428356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c596-20.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
5516	svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe
4172	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCBCCCCACBBACBCCABAACBCBCACCBACBBABCCCABBBBCAABCBACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe"	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCACBCACBBABABBABCACACBCBAAACCBCBCACAABAABACBACBACBCBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe"	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1532	sc.exe
4580	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe
1368	cmd.exe
2976	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1816	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
5516	svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe
5516	svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Token: SeDebugPrivilege	4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
Token: SeDebugPrivilege	5516	svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 1904	4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	91
PID 1904 wrote to memory of 1816	1904	cmd.exe	93
PID 4560 wrote to memory of 1376	4560	svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe	94
PID 4136 wrote to memory of 1368	4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	97
PID 1368 wrote to memory of 1532	1368	cmd.exe	99
PID 4136 wrote to memory of 2976	4136	2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	100
PID 2976 wrote to memory of 4580	2976	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d2b823c004ea8df65619fcfb655e8ca5_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCCAABBBBBABBACAABCAACACBBBBCCBCCABBBAABACBABBCACACCBCCCACACCBAABBCBAABACBCCBCAABAACCBCBBCACBABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCCCAABBBBBABBACAABCAACACBBBBCCBCCABBBAABACBABBCACACCBCCCACACCBAABBCBAABACBCCBCAABAACCBCBBCACBABABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe" start= auto displayName= "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe" start= auto displayName= "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBBCABABABBCBAABABCCBBBBABABBBABCAAABACBCABAAAABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1376

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBBCBBCAAAAABCBCCCCCCBABABCCABBCAAAACBBCCCABBCBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
1⤵
- Executes dropped EXE
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fcc29ac72dafd716a2d6a1a11969744eea31f6d7e3ac9d998e9e914b7adcb266
MD5 dc483b1df94ae8c2bf8ffc4cb0385b66
SHA1 8ac511eaf5215fb273b114ca59d29b6f920ea5e7
SHA512 ff20f897891ebe7c5f1163aca0ab0985c32b35733a8ade19a6c8c4a2452de43a8f551651f6489a2aecc1ef6fd88984a421cbd35d6847708490f2b0d06a15f795
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64f4b2fa5ca360e8942eb965c6640acf36ec37b99c71852fad897fc4ec7fcf0e
MD5 c859e3e43fae3f99e0078a507fef8d78
SHA1 395d3de0cd1565b1ba022f70509bfc4507fa7473
SHA512 b1aa3fd179b7cf4c0b9fa0d9bdb4653115dc96ef3ead5545cc8a92a28dd981ac33ba91041ee0eea97ad364188e953882c591a87fff61da3d2109edfe18b6e1a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 64b919f849723d35f5f1bd1c77323544f691dca03405d16795b79f490e9b588f
MD5 2c120ea6699a1f809d457e3573b6bc0e
SHA1 21a99b6e78f169c077e0732f4e95a6360eb82fcc
SHA512 ffb9195a945a7aa00a519b77f71c9d5e7ca0e3415205ad2e4a54ed6ed8936c9859d501a567a476d3bdf8f7a76da3e07d67010362e4cbd9bde90ca1aab3b2a990
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d1841aae3f67f46c1793980ad92f1332c3062a040f3b9c0e9b83ec0f5d2797a
MD5 fdedf96eed3d110b2b83115c43ad3ec2
SHA1 a9b5c7a94b2ca72fdb131347369c9132552fa475
SHA512 e6c16eb9f3bcd9821cf6dcbc5fce964f10b3ddc4eb1c87618c10aaaba2b42d803a85550cc487b1582d96e974b1801e3d2468f609091449d78b3ccb8c2b536a85
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 98b14cb99ce69ab63f4e4fb3ac47872e8f63b53411ee14cd8154a2bcf61157b5
MD5 11f5e5c2a1d8b7ca68170a663b0215ef
SHA1 4182ac57e9519e2e2fa6df54b377b80534aa697f
SHA512 bd9af2bfacbc8389fc8f93913ac9117e04ac13b57ff2a4140d2a923aa6c42e8e2d244552839c2bda1afbbdcde2070124ffe785234f84c1a9da9f621b189332eb
MD5 SHA1 SHA512

Submit Download

svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACCBACCCBCACACCBABBBAAACCAACACAACCAACABCBCBABBAAABC.exe
Size 13.3MB
SHA256 4e5864eaf70e40df604ddc1982716c66bb223caae5a15b518fae20e7e8943157
MD5 d2b823c004ea8df65619fcfb655e8ca5
SHA1 b192a73dae780bd6c860f850ac21e6e840a42d11
SHA512 df6f496ddbb7b3b78606f0f8ed112a409b9698df23493ea271824d0a9e1034a2ee9d25dadef8b2d9abe0ee55b31197ad8eba296bfda7cb8283c26ae27167a9eb
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsx:a111zXu111zXG
TLSH
T17CE6B009FD8744F1D92761B00CDBE3BF8A707A25C5228DAAFB4DCB1B6933B615428356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d4abd3d57bd8edf2d869d483a857f59251b3515e6e1821939b5899b52d654005
MD5 392fa9bb990b1a2710215597671f7470
SHA1 0fc298cbabbd28ef452d0d7dd6d697f4e3a31d73
SHA512 5ef74b01db3dced004866415f1b54202df6a231850c5617badb7760f1a6e67b01b1aff5ea4d82e9e46b26d582f1971a524f93d76b6e4841b150bad2fb085fe31
TLSH
T107110420B0B5C8A3E232F8CF9A25E9E64CF5B39BAC546A142399811C6785823CD1D4D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4136-0-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/4136-8-0x00000000005A0000-0x00000000005C1000-memory.dmp

Download

memory/4560-24-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download

memory/4560-34-0x0000000000EF0000-0x0000000000F11000-memory.dmp

Download