Analysis
- max time kernel
145s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 01:15
General
- Target 2026-08-06_bd1c24ef36dbdae52cfbafd83a3ec381_amadey_elex_mafia_remcos.exe
- Size 1003KB
- Sample260806-bl7wcsfa88
- SHA256 8a226bcc0ee9575fb13a91d2e9107f079ca088408271d1a3e1f89fa747e4618c
Malware Config
Signatures
- Executes dropped EXE 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_bd1c24ef36dbdae52cfbafd83a3ec381_amadey_elex_mafia_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_bd1c24ef36dbdae52cfbafd83a3ec381_amadey_elex_mafia_remcos.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/252-307-0x0000022FF9190000-0x0000022FF91F6000-memory.dmp
memory/252-380-0x00007FF7B2EE0000-0x00007FF7B32F7000-memory.dmp
memory/252-305-0x00007FF7B2EE0000-0x00007FF7B32F7000-memory.dmp
memory/252-306-0x0000022FF9190000-0x0000022FF91F6000-memory.dmp
memory/548-317-0x0000024352550000-0x00000243525B6000-memory.dmp
memory/548-382-0x00007FF757730000-0x00007FF7577E4000-memory.dmp
memory/548-316-0x00007FF757730000-0x00007FF7577E4000-memory.dmp
memory/548-318-0x0000024352550000-0x00000243525B6000-memory.dmp
memory/1004-276-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1004-355-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1004-277-0x0000000000810000-0x0000000000879000-memory.dmp
memory/1004-282-0x0000000000810000-0x0000000000879000-memory.dmp
memory/1008-357-0x000001FE55EA0000-0x000001FE55F06000-memory.dmp
memory/1008-356-0x00007FF6EE6B0000-0x00007FF6EE93B000-memory.dmp
memory/1008-358-0x000001FE55EA0000-0x000001FE55F06000-memory.dmp
memory/1284-15-0x00007FF71E700000-0x00007FF71E823000-memory.dmp
memory/1284-18-0x000001D831050000-0x000001D8310B6000-memory.dmp
memory/1284-17-0x000001D831050000-0x000001D8310B6000-memory.dmp
memory/1284-16-0x000001D831050000-0x000001D8310B6000-memory.dmp
memory/1284-67-0x00007FF71E700000-0x00007FF71E823000-memory.dmp
memory/1368-364-0x000001C172210000-0x000001C172276000-memory.dmp
memory/1368-366-0x000001C172210000-0x000001C172276000-memory.dmp
memory/1368-370-0x00007FF657A70000-0x00007FF657F41000-memory.dmp
memory/1508-288-0x0000017BC19C0000-0x0000017BC1A26000-memory.dmp
memory/1508-289-0x00007FF65FDD0000-0x00007FF660514000-memory.dmp
memory/1508-290-0x0000017BC19C0000-0x0000017BC1A26000-memory.dmp
memory/1508-365-0x00007FF65FDD0000-0x00007FF660514000-memory.dmp
memory/2136-345-0x000001D438920000-0x000001D438986000-memory.dmp
memory/2136-353-0x00007FF6692C0000-0x00007FF6695E1000-memory.dmp
memory/2136-344-0x000001D438920000-0x000001D438986000-memory.dmp
memory/2136-350-0x000001D438920000-0x000001D438986000-memory.dmp
memory/2136-346-0x00007FF6692C0000-0x00007FF6695E1000-memory.dmp
memory/2280-0-0x0000000000020000-0x00000000001FD000-memory.dmp
memory/2280-7-0x0000000002DB0000-0x0000000002E19000-memory.dmp
memory/2280-28-0x0000000000020000-0x00000000001FD000-memory.dmp
memory/2280-6-0x0000000002DB0000-0x0000000002E19000-memory.dmp
memory/2280-1-0x0000000002DB0000-0x0000000002E19000-memory.dmp
memory/2572-343-0x00007FF6C8440000-0x00007FF6C858A000-memory.dmp
memory/2572-270-0x000002B8929A0000-0x000002B892A06000-memory.dmp
memory/2572-264-0x00007FF6C8440000-0x00007FF6C858A000-memory.dmp
memory/2572-269-0x000002B8929A0000-0x000002B892A06000-memory.dmp
memory/3016-296-0x00007FF638930000-0x00007FF6389DE000-memory.dmp
memory/3016-297-0x00000266A1E30000-0x00000266A1E96000-memory.dmp
memory/3016-298-0x00000266A1E30000-0x00000266A1E96000-memory.dmp
memory/3016-371-0x00007FF638930000-0x00007FF6389DE000-memory.dmp
memory/3604-388-0x00000238C3F70000-0x00000238C3FD6000-memory.dmp
memory/3604-387-0x00000238C3F70000-0x00000238C3FD6000-memory.dmp
memory/3604-386-0x00007FF6FA7C0000-0x00007FF6FA8EF000-memory.dmp
memory/3788-42-0x000001AB56F40000-0x000001AB56FA6000-memory.dmp
memory/3788-41-0x000001AB56F40000-0x000001AB56FA6000-memory.dmp
memory/3788-43-0x000001AB56F40000-0x000001AB56FA6000-memory.dmp
memory/3788-40-0x000001AB58000000-0x000001AB58127000-memory.dmp
memory/4424-324-0x00007FF6D85B0000-0x00007FF6D8679000-memory.dmp
memory/4424-247-0x00007FF6D85B0000-0x00007FF6D8679000-memory.dmp
memory/4424-249-0x0000016472440000-0x00000164724A6000-memory.dmp
memory/4424-248-0x0000016472440000-0x00000164724A6000-memory.dmp
memory/4452-325-0x00007FF6687B0000-0x00007FF668A53000-memory.dmp
memory/4452-328-0x000001BE62230000-0x000001BE62296000-memory.dmp
memory/4452-327-0x000001BE62230000-0x000001BE62296000-memory.dmp
memory/4452-385-0x00007FF6687B0000-0x00007FF668A53000-memory.dmp
memory/4880-50-0x000001C050890000-0x000001C0508F6000-memory.dmp
memory/4880-49-0x00007FF73B200000-0x00007FF73B368000-memory.dmp
memory/4880-58-0x00007FF73B200000-0x00007FF73B368000-memory.dmp
memory/4880-56-0x000001C050890000-0x000001C0508F6000-memory.dmp
memory/4880-52-0x000001C050890000-0x000001C0508F6000-memory.dmp
memory/5020-335-0x000001865C350000-0x000001865C3B6000-memory.dmp
memory/5020-337-0x00007FF69EEC0000-0x00007FF69F055000-memory.dmp
memory/5020-336-0x000001865C350000-0x000001865C3B6000-memory.dmp
memory/5020-393-0x00007FF69EEC0000-0x00007FF69F055000-memory.dmp
memory/5036-62-0x000002CA7C950000-0x000002CA7C9B6000-memory.dmp
memory/5036-63-0x000002CA7C950000-0x000002CA7C9B6000-memory.dmp
memory/5036-61-0x000002CA7C6F0000-0x000002CA7C817000-memory.dmp
memory/5356-334-0x00007FF7EED60000-0x00007FF7EEE7A000-memory.dmp
memory/5356-255-0x00007FF7EED60000-0x00007FF7EEE7A000-memory.dmp
memory/5356-257-0x000001B53A900000-0x000001B53A966000-memory.dmp
memory/5356-256-0x000001B53A900000-0x000001B53A966000-memory.dmp
memory/5620-238-0x00007FF6D85B0000-0x00007FF6D8679000-memory.dmp
memory/5620-315-0x00007FF6D85B0000-0x00007FF6D8679000-memory.dmp
memory/5620-240-0x000001B4AF6F0000-0x000001B4AF756000-memory.dmp
memory/5620-239-0x000001B4AF6F0000-0x000001B4AF756000-memory.dmp
memory/5956-31-0x000002542BBE0000-0x000002542BD07000-memory.dmp
memory/5956-32-0x000002542BD10000-0x000002542BD76000-memory.dmp
memory/5956-33-0x000002542BD10000-0x000002542BD76000-memory.dmp
memory/5956-34-0x000002542BD10000-0x000002542BD76000-memory.dmp
memory/5960-374-0x0000015864460000-0x00000158644C6000-memory.dmp
memory/5960-376-0x0000015864460000-0x00000158644C6000-memory.dmp
memory/5960-375-0x00007FF61A580000-0x00007FF61AA87000-memory.dmp