2afcfdbbc03af45a2af11ac29c8f6cf78955aba82c4dfe53544185518e10100e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
Size 77.4MB
Sample260804-mlfyeshf24
SHA256 2afcfdbbc03af45a2af11ac29c8f6cf78955aba82c4dfe53544185518e10100e
MD5 9e8c1f3e65ed4701cc54bd1b6e8e4a74
SHA1 2c59ed166e0d14e9918b14c973906bba7c71a64c
SHA512 695de122c379b31b383d5aa87d73ed673333c6d0e8e3c16479ac84b2bc1b584dc7913ac5c3520daa6c196fe84f0da10e936fc059b229114e34a60d6d8d10f137
SSDEEP 1572864:a111C1113111C111C111C1113111C111C111C1113111C111xn:E
TLSH
T1A808AF09FD8744F1D92B61B00DDBE3BF8A747A25C4228E7AFB4ECB1B6533B215418256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
2004	svchost_AACBCCCCABBBBBABBAACBABBCCABBBBBBCABCABABCCCCBCBCBBAAAB.exe
464	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABAACCABCABCBAACCCCACCBCAACCBACCCBBACACAACBABCBCCCABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBCCCCABBBBBABBAACBABBCCABBBBBBCABCABABCCCCBCBCBBAAAB.exe"	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAABBBAACAAAABACBBCBBBCABCAACCBCBACAABBBCCABCBBABCAACBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe"	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4308	sc.exe
2932	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3128	cmd.exe
3576	cmd.exe
4260	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBCCCCABBBBBABBAACBABBCCABBBBBBCABCABABCCCCBCBCBBAAAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
Token: SeDebugPrivilege	2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4452	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3128	2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe	112
PID 3128 wrote to memory of 2488	3128	cmd.exe	114
PID 2556 wrote to memory of 3656	2556	svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe	115
PID 3656 wrote to memory of 2056	3656	notepad.exe	116
PID 2400 wrote to memory of 3576	2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe	120
PID 3576 wrote to memory of 4308	3576	cmd.exe	122
PID 2400 wrote to memory of 4260	2400	2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe	123
PID 4260 wrote to memory of 2932	4260	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9e8c1f3e65ed4701cc54bd1b6e8e4a74_amadey_coinminer_darkgate_elex_hawkeye_hijackloader_remc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBCABBBBBBABCACCBBABCACCCAACAACACAAACCBBABACBCACBCAACBABACCCCCCACBCCCABBACAAAAABCACABCAAACBBAABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBCABBBBBBABCACCBBABCACCCAACAACACAAACCBBABACBCACBCAACBABACCCCCCACBCCCABBACAAAAABCACABCAAACBBAABAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe" start= auto displayName= "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe" start= auto displayName= "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAABBABBAACCABCCCCAAAACCBCACCAABBCACAABACCCACBACBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2056

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCCCABBBBBABBAACBABBCCABBBBBBCABCABABCCCCBCBCBBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBCCCCABBBBBABBAACBABBCCABBBBBBCABCABABCCCCBCBCBBAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABBACBABBCBACAABCACBABACCABCBCABBBABCBBCAACCBBACBBACC.exe
1⤵
- Executes dropped EXE
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aafcd146ae004894377f4706495c493202bfcfcbd342c1f8b89888a1003e5f91
MD5 e43443be08bad4314f75656af855841a
SHA1 991d8a0008129ecf7236603242b758fd4c6f2b7c
SHA512 ac9bd4c8d8809e7a5c4c0ef7cafb6b22aa982ac687da8a2e920942193dd194f2379340f87f87de89bd23aa07e5d8834b24f262d001e7647353bd1220ce5bcede
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4352445907c63dc2e8ff394ab41c1e6dafa682d938e40e508f6f34e19f1f96c1
MD5 e530ed6d12e91e7e8de1a1b391df2a0d
SHA1 6d8f1c363720eb9ca32247b9de26200f5f17130e
SHA512 dfbcf68116f9afb32cd6e060f9765c18e63e4d527993b0647184beb39645cebacc823f01c3465f874a7e294dd36b934fce9231a7c25c2e259973336385747722
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e1c6fe8d413e80c666a484c01f9ca43fc13c5b28996528c7247f737fe9e843b
MD5 0d9330417a387c138a04b063005d7b0a
SHA1 a00984641927bf66f6e8867947fbb56b1c6d03bb
SHA512 c0869f8410895d88906935da7b43e0d423d8302b6b7ac7ec3c3dcc014d23cba7ec289739ffb16063523a7bc3b1dec4c6b98a2797c50217c172d94843a2429aa1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed6fad90d5ea1f4a77e61d27c25bcc053a6eb1f3bf9060ac576a9004cac2cde5
MD5 6b3e1560aa74e38e0c7b721692a295d0
SHA1 62c072cfc485de80f7ad52f8b0d9dc56e9c1040d
SHA512 4033dc4d53d76293faf0bee67a5fa86538acd23f7a5a3543949e4ba855f9e777e950d5c727e696108eb8d7e53c11f9415b97c5e468ea9d1ab8716e9b9de30825
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b37630e98b5b5503d6127831c56056e34eb4456da8fc4532287910e977579341
MD5 365e2306b5a81481ad5f4d2f96182e17
SHA1 9f28b9fb7712ec5a04bd4caa43c554d63c93dda4
SHA512 f671f7de36d05e5a0f9e35b2ac0b2cb70a6d2c24be3d7fe3df18bca11a5fbf62e3d0a478fe67503de1de5d72f07216d502b28f547c5d4c97748795ad0f24c9e6
MD5 SHA1 SHA512

Submit Download

memory/2004-78-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/2400-0-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/2400-8-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/2556-27-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2556-37-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/3656-59-0x0000000002D60000-0x0000000002D61000-memory.dmp

Download