b02449e3be3e50362b0d8c9880513523563e07960b546db8e6b07418dff9e8e0

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
Size 19.6MB
Sample260810-b64dnssyds
SHA256 b02449e3be3e50362b0d8c9880513523563e07960b546db8e6b07418dff9e8e0
MD5 ebe0c6d16a211c038571f3e6a8494bb7
SHA1 aeb1f5ce4305597cad5ba96e65e8ece4c6d7dea5
SHA512 4340bc77ff5fb1a4acef775bd58c912904db61f32f1eb27acddc331875610dd6fce0cb259702c14f759200cef60c253cd9da467c9d472e7bf1a081327ec58cd3
SSDEEP 98304:T7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pG:c
TLSH
T1E5273A02B7E99034F6F31B30AEB992754A7ABD62DD35C60F63845A0D1D70A90E934B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
1160	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
6016	svchost_BCCCBBBBBBCBBACBBCBCACCAAABCCBAABBBBBBAAACACBBCABCAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABACBCACAABCCCACCBBACBCCAABACACABACBBCAACACBBAABBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe"	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBBCCABBABCCCBCCBBCCABABCABBBACAACCBCBAABCBBBCABABABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCBBBBBBCBBACBBCBCACCAAABCCBAABBBBBBAAACACBBCABCAAACC.exe"	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5840	sc.exe
4912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5584	cmd.exe
5028	cmd.exe
2872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCBBBBBBCBBACBBCBCACCAAABCCBAABBBBBBAAACACBBCABCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
Token: SeDebugPrivilege	5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 5584	5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe	96
PID 5584 wrote to memory of 2140	5584	cmd.exe	98
PID 5636 wrote to memory of 3784	5636	svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe	101
PID 5316 wrote to memory of 5028	5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe	102
PID 5028 wrote to memory of 4912	5028	cmd.exe	104
PID 5316 wrote to memory of 2872	5316	2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe	105
PID 2872 wrote to memory of 5840	2872	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_ebe0c6d16a211c038571f3e6a8494bb7_amadey_darkgate_elex_hawkeye_remcos_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABCACBABAAACAABCCBABBCAABACBACAABAAAABACBBCACBAABBBBABBCCCACCAABBAAACAAACBBBBABCBBABACCBABBCAACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABCACBABAAACAABCCBABBCAABACBACAABAAAABACBBCACBAABBBBABBCCCACCAABBAAACAAACBBBBABCBBABACCBABBCAACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe" start= auto displayName= "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe" start= auto displayName= "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABCBBCBBCCCCBBABCBBAABCCBBACCCACAAACCBCCACBACAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBBBBCBBACBBCBCACCAAABCCBAABBBBBBAAACACBBCABCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCBBBBBBCBBACBBCBCACCAAABCCBAABBBBBBAAACACBBCABCAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SuspendRename.exe

Path C:\Users\Admin\Desktop\SuspendRename.exe
Size 40.0MB
SHA256 f921e860a3ca972886537fb2243ffdb70276b395ce9f262c8b3bf11a6e1241c1
MD5 be7914af6b41b440302431ef11b65403
SHA1 645535cfd4f7d1b9b262203dbc78cf60e5b94868
SHA512 218f79ec3f12fad743a954c0bf75f33ff6ff81bade6a161e9816e19f2337fd3124874f5af04add062b678f7c2b9273713e591dfd97b0f3062d24f4b019fdb69e
SSDEEP 98304:T7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pu:jN8x
TLSH
T19A974A02B7E99034F6F31B30AEB992754A7ABD629D35C60F63C45A0D1D70A90E934B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6938a3c6c48b6f7fe5c7786aec2a1d69f6f9668195359ef273eeb5203def48eb
MD5 2f92710c4c83322dfdc0f203128fea68
SHA1 95c893b78d5184123245ee0e73b7c300817a99d9
SHA512 fbd1c47c8dbd24096c238830e558014d647350a36262c44812954a900e82802954d93245ed2bf2254d8539cad838f118bfcc1e0cf4be2de8b22d2eb27d149aae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 969180adf33abcad8ddc28d62ebc96919a5b1301f4c998e761ae482908aff7bd
MD5 f52eeec2461ad989dd651ac7a2ec5409
SHA1 dac9fdab32b5f6de323c3a51f1c1d32bb44ea31a
SHA512 4455d9c38b7d7c7a88e956796e4409146f2ad5772e1e9d2aaab6bbbfb69858a9f65f5d5b39e1a03d8dcc5c649dc240631fdb5f68e608aa0c522036552be591f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7170731ec4dc6474c242f1cf22a9e4db9738d928d967094e7fdcc1fe5d41bbcd
MD5 8eff0782bf33181dc17a96d6a5343666
SHA1 60d3c1f1799dfaa5fac1fcd4257701aad81550d8
SHA512 3cbe2c66498c8b161546a4b5392fc7fe57126537d7e294f08f364d9b8ae4f6542862f67065d0a1fd94f47fac63e17c7e9c40da8bd57273984f9920e65adcaf6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58b09b2545a6b71f921aaa2df9e5a059a21f580162ec492d62e8e7e891472136
MD5 d87c62db548e9f72dab89e7c7cf7f22f
SHA1 f6ed4db3875b1db3a1bfba3857b8657ed6299696
SHA512 848e3ff67a20ac9af280f94eeeefcaa1e04af420d5cb1d12b2226d92c063d5874d291a37749ad7826032fa5810f89bee5ff907b561115b6c5a38c3e8d6619f22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c05811675977ba35e0c3cef7a04de1328ea45e896ca275e6affa5338e4104133
MD5 bd886572ccc3d25c4f04b29ba1d9168b
SHA1 ade881b44c1ee7df96fae9b5bac382ad156fc74c
SHA512 c02722a0684a94fae13ee6d4dcb3a2b394fe70bc86bf09e787f3681d3fbcb9c66b988745ffa6f316d3ae13e20704648ddbfbb066ed5be7c70c78539209a9a255
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 856a63e828a860c03c27a48e6f42da523bb2df30e94a5ec32e3013e612f4d94a
MD5 a993f7e846314e23ef5b37cd163bc248
SHA1 bce2a69f0b60c52d8d426a575dd655184a85bd0d
SHA512 f01126d73dfe171cb9e80fdd74625b425cd9470f63e84163b498f0f2b591875d0dc64cd1ce9bcfca89c31d5d2b76f217e2ef9f42dd9936d55b5e5e456322e809
MD5 SHA1 SHA512

Submit Download

svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBCACBCCABBCABAAAAACABCBBBBCCABCBBCBCACAAABCBBBAAACC.exe
Size 19.6MB
SHA256 b02449e3be3e50362b0d8c9880513523563e07960b546db8e6b07418dff9e8e0
MD5 ebe0c6d16a211c038571f3e6a8494bb7
SHA1 aeb1f5ce4305597cad5ba96e65e8ece4c6d7dea5
SHA512 4340bc77ff5fb1a4acef775bd58c912904db61f32f1eb27acddc331875610dd6fce0cb259702c14f759200cef60c253cd9da467c9d472e7bf1a081327ec58cd3
SSDEEP 98304:T7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pW7pW7pW7pk7pG:c
TLSH
T1E5273A02B7E99034F6F31B30AEB992754A7ABD62DD35C60F63845A0D1D70A90E934B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1160-109-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5316-107-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5316-15-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5316-44-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5316-77-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5316-29-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5316-0-0x0000000000C20000-0x0000000000C41000-memory.dmp

Download

memory/5636-43-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5636-91-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5636-66-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/6016-117-0x0000000000020000-0x0000000000041000-memory.dmp

Download