75d038f9ba628d13bfdc72de82955ac867dcd4f450da7c4255c5e57ca7adf8bc

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
Size 5.3MB
Sample260808-bwpsjaxeje
SHA256 75d038f9ba628d13bfdc72de82955ac867dcd4f450da7c4255c5e57ca7adf8bc
MD5 41c48e504f27ecf519394ffb78b33f13
SHA1 db23a99cebae294145d88132ab46204f671e42d0
SHA512 53bd8c38d868bb0149d21f13f65a6984324633466249af90855c3d333d7963049ba00972fd6a02a0a69ac67c2bcb78070b3b17e62ad5f23e7a58f92354f57a6a
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7mp7Dp7Dp7Dp7Dp7y7p6:vBBBB0BBBBJ
TLSH
T1EC467B10B7D18035F5B329728ABFE339552DB9714F6986CFE388062E5D70AE0A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
6132	svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe
2812	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBAAAAABBCACABAABCACBACABCBBBCCCBACCBACAAAAAAAACBCABBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe"	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABCBBCBABBBAABBBCCACCCAACBAAACBBCCACABAABACBABCBBCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe"	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2380	sc.exe
3996	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2432	cmd.exe
5732	cmd.exe
2084	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
6132	svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe
6132	svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
Token: SeDebugPrivilege	5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
Token: SeDebugPrivilege	6132	svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 2084	1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe	92
PID 2084 wrote to memory of 2772	2084	cmd.exe	94
PID 5368 wrote to memory of 2864	5368	svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe	95
PID 1468 wrote to memory of 2432	1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe	98
PID 2432 wrote to memory of 2380	2432	cmd.exe	100
PID 1468 wrote to memory of 5732	1468	2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe	101
PID 5732 wrote to memory of 3996	5732	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_41c48e504f27ecf519394ffb78b33f13_elex_hawkeye_remcos_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBABCBBBCCBAABBCCBACBCAAACBACCCAAABBBABACBCCACCCBACCCCABABABAABBACBCAACBCBBBBABBBABBCCCAACAAABCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBABCBBBCCBAABBCCBACBCAAACBACCCAAABBBABACBCCACCCBACCCCABABABAABBACBCAACBCBBBBABBBABBCCCAACAAABCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe" start= auto displayName= "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe" start= auto displayName= "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBBBCBCCBBBCBCCCACCBBCACABBBCAACACBACCACBBAAABBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBABCCBABCABBCCCBBBBACABABBCCCBBAAACCBBBCABAACBBACBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
1⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8fa81b79fde4a7c6b49e7d746f0e44d3243e2c5b637aeeed8bc4d14ae9f13091
MD5 f67365f356ae2eca9ce39b4cb37c7c60
SHA1 d3b94dbed7dd5ffc51c663f841490f3cc2ff13ab
SHA512 a140825378f85606b0fce63ec59e574a39d6c0ba9f56a1ec371d28f23d79bb272b23e7fcad71344f05173548cea59c0dabc61e0175b90b45e88af41bbf9e1e47
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f991a053b00ebd665f07d5fc61c33766795dd69336debaf31ba39e2bdfba2caf
MD5 99a651a502c42884887cae982c781f70
SHA1 7816c202c17e81f49f67ba256be26ec8d599477f
SHA512 eac07a47c4fb4234dd558fb9b568e0dddf9090d98bbca51bf3a66b9cbd02ba247c254317d22374d638e24c0f3b5fbcac69added5431b808adb51f4eb9ac44c06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6a4cfa3a4f3046f5725f24976aa4ca8573a51b9db55249169b9fb10f5f469555
MD5 88b0740893053653aebc6b178e948591
SHA1 574f2e01a4b8a9d81944c18d5328509ebe50d05f
SHA512 637a59ffd539e29d3d3b1ffdbe9b8b5079673e9256cf9a74ae0d9ad3bf839e47cf638b4e5a67465f0b114d9b8df1a267d9c89aaaf68892088ccd685d7452408b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41f56cef3f2e55c7850ece8d504a378aa77fd8d0a99bd538a3cffda054c04a66
MD5 70df315fab3e331f050887fd97c539cf
SHA1 25adab58f49ae74b49f7725890349eac3aebaa3d
SHA512 8a89d9f477c6e18442fb06b6405f243fb96cbc814f1c468c0eed9585e7b1d7807494065ee6d0da0146153127476de76a2a115d82951c0396725ba15db412b8fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60d2cc668a3c90d90a7677932cf8d9caedf81a2ae54701edc86ab85fd454c81d
MD5 c1c10a248d53e4e6586bf0d21dbd7ce6
SHA1 3f53495a6161a58561637228f29fc4039970aa61
SHA512 717e0e0b3d289a4b42a1228ae22f84962b6f5bdc613f6e1fa96216a9902b930d83a3053f60dc9376cf6e7011defd267f3d0906fe2e0d9e39784079e484a5d8de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b33bfc0f2060f783e5cd3eeb35fd5b0c29529b898d8717a57e61a81c41184a12
MD5 0a1d4c66cd71fc292baa996d5375d696
SHA1 a58577311a6a03ff0bd0b94f1162b7225dd7db9a
SHA512 66e5a99523df17f147a9df574af42b733110803c8970bb3949ea7d6d576ad4145e45ffcf3b7ed2c4d221a4771c73c1f253ef64869e0207ff4fa4f5c6e92d8f62
MD5 SHA1 SHA512

Submit Download

svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCCCBCBBCABAACABACCBBBAACBCACCBABBABACCBCABCABCABCBCB.exe
Size 5.3MB
SHA256 75d038f9ba628d13bfdc72de82955ac867dcd4f450da7c4255c5e57ca7adf8bc
MD5 41c48e504f27ecf519394ffb78b33f13
SHA1 db23a99cebae294145d88132ab46204f671e42d0
SHA512 53bd8c38d868bb0149d21f13f65a6984324633466249af90855c3d333d7963049ba00972fd6a02a0a69ac67c2bcb78070b3b17e62ad5f23e7a58f92354f57a6a
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7mp7Dp7Dp7Dp7Dp7y7p6:vBBBB0BBBBJ
TLSH
T1EC467B10B7D18035F5B329728ABFE339552DB9714F6986CFE388062E5D70AE0A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a8abea47d126240e3ef9b328a473c71b084a6f7ab4dd52b440778159a999345f
MD5 0537437bc4555accf8adbae567bb64c2
SHA1 7dd8083f3c1aeca5a5cc333511d5456400fcf437
SHA512 aab0c5db59532b02391642abf0c1f8f16793a81bb77e379675911df96701a35b0332c3e9a74c42cf8c6619cf952d33abdf5a24ef330ab312b3b0358317011212
TLSH
T1A911E750A0B998A3F53378DF5A35C9838CA4379BA85CAA19D20D821CB7D5C31DD29CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1468-7-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/1468-0-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2812-81-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/5368-23-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/5368-34-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/6132-79-0x0000000000640000-0x0000000000661000-memory.dmp

Download