356a40dc2a24215ee16a36064eccd338d4541eac59ad7c67131b68d3bdc692eb

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Size 16.1MB
Sample260730-dlm73aah52
SHA256 356a40dc2a24215ee16a36064eccd338d4541eac59ad7c67131b68d3bdc692eb
MD5 a3e9b96bee158aaf5a7acb409192de04
SHA1 79d950d9528bb7664504142edda77b55d373cc78
SHA512 1c31b8f1770b7429bbd83baa81c13c98a3b40e4ccc86a49054befdc310aa622d10542862be8bd1a37ac45870a1b67b6cb53af87286b61f3857dcec28f65fdfe6
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsyg:a111zXu111zXvg
TLSH
T12007B009FE9640F1D52B91B048DBE3BFCA707D1985318DABFB498B1B6A33B61582C351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000245b9-23.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1960	svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe
1324	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBBCABBCCAAACACCACBBBCCCACAABCBCBBABBCACACCBBCBBCBAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe"	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBABACBCBBBAAABBCACBBCBAACCAACABCACBCACCBBBBBCBACCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe"	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3920	sc.exe
2316	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1772	cmd.exe
3468	cmd.exe
3544	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1960	svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe
1960	svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
Token: SeDebugPrivilege	1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
Token: SeDebugPrivilege	1960	svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3484	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1772	3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	97
PID 1772 wrote to memory of 752	1772	cmd.exe	99
PID 1672 wrote to memory of 2388	1672	svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe	100
PID 2388 wrote to memory of 4424	2388	notepad.exe	101
PID 3492 wrote to memory of 3468	3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	105
PID 3468 wrote to memory of 3920	3468	cmd.exe	107
PID 3492 wrote to memory of 3544	3492	2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe	108
PID 3544 wrote to memory of 2316	3544	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a3e9b96bee158aaf5a7acb409192de04_amadey_coinminer_elex_hawkeye_hijackloader_remcos_smoke-.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACBABBBBCCCCCCABCBCBACCAACACAAABCACCBABCBCACBBCABCCABCBBBBCAACCCBAAACCACBABCCCCBBACAABACAACCAAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACACBABBBBCCCCCCABCBCBACCAACACAAABCACCBABCBCACBBCABCCABCBBBBCAACCCBAAACCACBABCCCCBBACAABACAACCAAACACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe" start= auto displayName= "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe" start= auto displayName= "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAACCCBCCACACCCBBBABCAAABAABBBAAABBACACABABACCBCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2316

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3484

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBACACCBAABABCCBCACBBBBBBCBCACCBCBCCAABCBACAACCCACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
1⤵
- Executes dropped EXE
PID:1324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 45734d5f9cf32c2b74ee265bf29fb25967f65fb32cdc22bd5f308010b3d27619
MD5 de84e4cefa4f52973a479ef47a70d98f
SHA1 550c754952c55ff028431a5225dd46034173fb5f
SHA512 6fa91a954267c33ceb93a8cb08afb75892ac7cca3ed1e4fad517ccf88404b5a451476b8162e7b702501d45a662b7432006da771bea84ef041fef7796f78298a7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0dfc9c6eab1cf14d48bfd6725b840302dd7bc6cd549b3dccfeba3adf62203edb
MD5 7208256050c1cc6c0b04c282b0ff02e6
SHA1 74c0e23d44455e50c59fd9ea1ed3a6db46c70238
SHA512 450ec523c7c93d3881d72365de85c5fe756b68b94e7d7c71e40fe20e2b7a587673a5362fbf749db46ca0a1777cc4cac26c449c1d3315a1d171d4e15ea48b56c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c06190a24499ee84786153af77003d16557148218cd54070f1a40ea47c684af
MD5 18fcfc97d8bf65ee1545454c9d4dc237
SHA1 dfe9366737c9055e15194084bb3c2f2209835ef0
SHA512 52aafd1258928d6ad9d87c53beea9dc09b6372dd83db3c033f2ef1f80c6ca8e06eccee0627a7aa7810c26968082802d4bfd14f90474982569cb0f751c064384d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2c130ecc82c8311fafe7e083b8b1a94caf3e607c279c931e68fde7f50814b625
MD5 ae4b5996b5473dd2bb8c036770cbeb02
SHA1 a42b737ff6c99097f3f4f8c4db41520df467051b
SHA512 63049a1058508e28b8f3e9d26beee8da64a550a0fd9e902f2342f3c0b71b52e0adbf69690844c666d98bbcad80f64dafdc8705daadf0c7da4c5a32bcf65d4c77
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e613207242b5001599ed5baf792d88794039bff3bfa5c2821c1c017ffd1fb396
MD5 3c09e2758bb612179c792f8fbbdffa06
SHA1 6777b25426d668e8940dedd0a5ede9e70081f7ac
SHA512 49a6867ab25d444432ff3dac244513ce890bb30095ec17f4fd4e86ad12ee61c6a2fd42d9f76da5819cb261777d5395f0e277abff37c649c3180e9745b350231c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2919f9b1ba5ff29641919f1f47665a76633b0461ddfd2182b67cca8c62013db5
MD5 506ede0790eed51ac04d91bb993a1e74
SHA1 ae53f630ab666ac74ca3448edb8270a2ae0bbc9d
SHA512 a2da6163b68278f91100248952b8f6d20ad4ed0f86aa911b76f95493894a99410877ad40fdfd0b6d0bdc83e167a847032482a69805f4848b4bc3373b2d6376f6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 813bd6938793f3512d394f8b8f379cc96aeb1eebfaf8cfb230d2477bcc2ddb1d
MD5 eff7044c4d3b1df33b0ad0cd18db9f03
SHA1 47987db153c8b51b8e2554e02a0f316a780b3a62
SHA512 3e2a409dee8e2679d8aa2593b30faa50c40be0d289ab9bdf4343fa7fdbefe3b2405cfd2df992b8866d8a1c2ddcba4b5c93a19e20bd9ad0a7cfabdd993d368bf1
MD5 SHA1 SHA512

Submit Download

svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAAACBBCBAAAAABCABCCCACBBCCBBBABAABBBBCBAACABCAABBABCB.exe
Size 16.1MB
SHA256 356a40dc2a24215ee16a36064eccd338d4541eac59ad7c67131b68d3bdc692eb
MD5 a3e9b96bee158aaf5a7acb409192de04
SHA1 79d950d9528bb7664504142edda77b55d373cc78
SHA512 1c31b8f1770b7429bbd83baa81c13c98a3b40e4ccc86a49054befdc310aa622d10542862be8bd1a37ac45870a1b67b6cb53af87286b61f3857dcec28f65fdfe6
SSDEEP 196608:anSunSunSunS+21Bu0FnSunSunSunS+21Bu0gxsyg:a111zXu111zXvg
TLSH
T12007B009FE9640F1D52B91B048DBE3BFCA707D1985318DABFB498B1B6A33B61582C351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 d481bdd0aeeda18be285d6d94a79292575897aa28d98bcb23dadf8c7cf6de520
MD5 0e56d055608667435a4a64fd0e4fd77c
SHA1 37e8a59ad5bc8b09d555d9ff3edd6164fe5f9384
SHA512 21e5a8ae0141762b7a8123bc0ce866eba487bef786fb511f6a1c0653164ec2788569142a8e6553fca981cf0c47025deb2e05c4bea38286a6e2306ce28be7d494
TLSH
T13611C1906165D8D3E13268C39715DBDB88E8B79FBC586E25231D871CAB08C33CD194A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-37-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/1960-82-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/2388-60-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/3492-0-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/3492-8-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download