0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Size 2.3MB
Sample260810-cf5pgshk6w
SHA256 0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c
MD5 b9a1b1c079aba5373682b7dbff6b4b7b
SHA1 4888ad045c0605012db34c0c2d31e7b203f74ab2
SHA512 f62c897adab4056752b3b7872109b117fd706234ad9ef16597c8e37cd30682460eaa5ff56bf5a55792c767329cf6917933874d242dd82ad1d41c33a2bff603ed
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbWiw2EDd79WCh:T7pW7pW7pGp7H
TLSH
T1E1B55C01B7E99034F5F32B319EBA92658A7ABC619F35C68F6384461D0D71AD0E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
1872	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
1008	svchost_BCACCCBBCCCCBCCCCCCABBAABCABBCBACCBCBACCBCACAACBACCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACABBBBACCACBBABBBBCACABAAABCCCBBBBBABBCAACAACBABBAACBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe"	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAAAABBCCCACBAABACCACBAAAACCBAAAABCBBBCABBBBBCCCBBBAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACCCBBCCCCBCCCCCCABBAABCABBCBACCBCBACCBCACAACBACCACAA.exe"	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2324	sc.exe
4896	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1208	cmd.exe
1740	cmd.exe
3872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACCCBBCCCCBCCCCCCABBAABCABBCBACCBCBACCBCACAACBACCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Token: SeDebugPrivilege	4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4960	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 1208	4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	96
PID 1208 wrote to memory of 4048	1208	cmd.exe	98
PID 4024 wrote to memory of 4328	4024	svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe	99
PID 4480 wrote to memory of 1740	4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	100
PID 1740 wrote to memory of 2324	1740	cmd.exe	102
PID 4480 wrote to memory of 3872	4480	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	103
PID 3872 wrote to memory of 4896	3872	cmd.exe	105
PID 4328 wrote to memory of 820	4328	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBBCACCCCACCCAABCABCACAAAABAAABBBCBBCAABBBCAAABCCCCACCACBAABAACBCCCACBAAAAACBBCCACACBACBBBCCCAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBBBCACCCCACCCAABCABCACAAAABAAABBBCBBCAABBBCAAABCCCCACCACBAABAACBCCCACBAAAAACBBCCACACBACBBBCCCAAABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe" start= auto displayName= "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe" start= auto displayName= "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCACACCCCABACAABBABCCBACCCCCCABBCCACAABBCABACCCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4896

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:820

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCCCCBCCCCCCABBAABCABBCBACCBCBACCBCACAACBACCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACCCBBCCCCBCCCCCCABBAABCABBCBACCBCBACCBCACAACBACCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd11b7be39357cccba4a0d74b98f6a2d1f0d1ff2c737b110b8b13e3f096da5ce
MD5 41df05cdc82aa65cd7fd67e0949a1ea8
SHA1 54d8b2b14aae57fac3ab3fb73846d7bf6abb56d5
SHA512 10a3ee4c7775ee829661dc6e398657f415f9a9304094b9ded70c2d254e0852ffd68cd6057324d4a39d48075e9829d411220de4c17473e92fbe30f5cf155d47d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7859c2d5a346e08b8ddf1bc8f331b307ec9ef89821d98fe4e9d841d55e4d497b
MD5 97215d83c32418b3c9d2ff7d0a649c9f
SHA1 340a7195136ff2f9bebbf5e9df0339cffaae17cd
SHA512 29b92696210d6dd0163485f89044d7b1c4d5ba7b3c2363d4d1510860e2b2354348be69884b6fd7446955ae61de338eb1519a96b8b6fc2921d5d6803b52d259c1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a2e6a5d14f4172cea30d10cd6522b4d7d121ef306f1232e4eae9d2be4f43f164
MD5 b7c80156a4c1c6410dbef9e984becae1
SHA1 8a1eaa90d77223780c79e29f4207deb1bb34bdd9
SHA512 1010c61b560f98010eb90f4429d50426fdfa2236af254fd807057b0988c75f51bdea9c1abefc065f8bfeb3c834e33f8985fee74435761c319a8f232ad51c791c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c047d61bab70e2ab2186a4142f5ffa5ceed65e97273b65fc0cca9ec9dde84664
MD5 be56aeb15b75e9484d0844960d692303
SHA1 5d82b3e80cbb0e83da77de2bf0f6f3781162cddf
SHA512 c77604121d6651de7f01baa8df0e1d6667c028563b0ea48e2180abe0fa65652a7f4f06f84cfa07665a377b5a65a19873e5b07e4daf6088d3e071224ecfa1a993
MD5 SHA1 SHA512

Submit Download

svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCACCCAACCBCACBAAAAAAABBCCABABBAACAABCABBCBCCBBCACCBAB.exe
Size 2.3MB
SHA256 0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c
MD5 b9a1b1c079aba5373682b7dbff6b4b7b
SHA1 4888ad045c0605012db34c0c2d31e7b203f74ab2
SHA512 f62c897adab4056752b3b7872109b117fd706234ad9ef16597c8e37cd30682460eaa5ff56bf5a55792c767329cf6917933874d242dd82ad1d41c33a2bff603ed
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbWiw2EDd79WCh:T7pW7pW7pGp7H
TLSH
T1E1B55C01B7E99034F5F32B319EBA92658A7ABC619F35C68F6384461D0D71AD0E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4024-27-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4024-40-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4328-67-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/4480-0-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/4480-8-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download