0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Size 2.3MB
Sample260810-cf5pgshk6w
SHA256 0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c
MD5 b9a1b1c079aba5373682b7dbff6b4b7b
SHA1 4888ad045c0605012db34c0c2d31e7b203f74ab2
SHA512 f62c897adab4056752b3b7872109b117fd706234ad9ef16597c8e37cd30682460eaa5ff56bf5a55792c767329cf6917933874d242dd82ad1d41c33a2bff603ed
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbWiw2EDd79WCh:T7pW7pW7pGp7H
TLSH
T1E1B55C01B7E99034F5F32B319EBA92658A7ABC619F35C68F6384461D0D71AD0E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
5256	svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe
3912	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCBBCCCACBBACBACAABCACCABABACBCCCBBAACCBBAACCBACCCAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe"	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCCCACAAABBBABCBCBCBBBCABBAABBACAABBABBAACCAACCCBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe"	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4660	sc.exe
2480	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe
2484	cmd.exe
2272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
5256	svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe
5256	svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
Token: SeDebugPrivilege	2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
Token: SeDebugPrivilege	5256	svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2272	1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	92
PID 2272 wrote to memory of 2876	2272	cmd.exe	94
PID 2416 wrote to memory of 6076	2416	svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe	95
PID 1308 wrote to memory of 1964	1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	98
PID 1964 wrote to memory of 4660	1964	cmd.exe	100
PID 1308 wrote to memory of 2484	1308	2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe	101
PID 2484 wrote to memory of 2480	2484	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b9a1b1c079aba5373682b7dbff6b4b7b_elex_hawkeye_remcos_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABCCCCCCCCCBCBACACBACBABACBABAAABCBCACBCCBBABBBCBCBCBBCCCCACAACCAABCBAAAACABAABCCABCABCABBCBCCBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAAAABCCCCCCCCCBCBACACBACBABACBABAAABCBCACBCCBBABBBCBCBCBBCCCCACAACCAABCBAAAACABAABCCABCABCABBCBCCBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe" start= auto displayName= "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe" start= auto displayName= "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBAACBABBABBABBACABCABCBBAACBACCACCBCCBCBCBBABACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABCABBBCCBBABACCACCABCABCAAAABBAACCACCACCABCCABABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
1⤵
- Executes dropped EXE
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b07f465f2b44126ed5d69bbb1a1b662d9546b7296cba413d721e130f8efa5d3b
MD5 f886cd97ea6ae8e56fcd8cd41d7df58f
SHA1 2d1e410ec9cafe191d22e92ec03cfd60a7295805
SHA512 267317b05acb75e7444879649412daae4f70e1f6cb747e56180f288a8350db60f3c816e88d5c82939171f77bf2d482f03dafe560708698736d051f433f70ac5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f1f433cea7371d27f354239423870e066d477633103424508096800e057c159
MD5 7e1ee642c14d7528ff1f2894283673f9
SHA1 52765c5109b45e3aa67fed286f195ef43d67fc05
SHA512 34f0ac4cb5584a8e35bbcb2503a36862a97d7d46846149c7dd0868ca6a71091e5ea524189f453db1ecf05d692e6ca1abb0d40bfb34a99bead2d84459bb2747cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2fc01fa4b9d357258b74d8ff730b133d30e672f57d2dbb0a8b48cd83dc7e86f6
MD5 c15c254542478b86a146553bdd7143b7
SHA1 6519a186c22448a1a6fa0a88e76dc1526bb7cc30
SHA512 d2eb1da3a7b8da3eb0647af5336ec8e96b99e8ec742052475bacea7771e43177f2dd151407b7d2ea4838841ca504302fa23737df8df95140a92e49f6ba4fb4b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 820b429e37acbb2a23941f88b092ce0dca085201a44192e014f4f1712c3eff03
MD5 ea0f8263184aec505420a159705eb23b
SHA1 172f4e0a244324e373c561d14940cf96b975de43
SHA512 1570244a0c41e2dc4754616c00f88b30e7199a8e5566b1e8952d1f023ab2c58551b5ed705ff200180fb610f697aa58780b54af7641e92e4e6a772c69d1d43744
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb4bc7a5c1c51ed18040612daee69beb3e34017d1f757f414564ca5e65c7959e
MD5 063992a75bf1fc35856265673d31f807
SHA1 0a4d436992c185101adb97e02b9299ba6b0ed803
SHA512 45ce9e1f97b1250d5a4c10cef41fccbd057d0ac65234e4b2a47305844d3b5b4d3a512d699c463e0c511dbfedae3fab30719809089f2a1c4fbfc8732be564f8c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 222865fa4ab4ad174a9c3916e9e7e8e5afaf1b712dff3d758127175f60fd30b5
MD5 a39f428330c7ab817eb05870068bae2c
SHA1 cfaecda19518d17a32fa8853806c92cb77459d01
SHA512 3368aacf0e550b7f5b0dd8139741da2a469eba4067bdd199f7907bf6946478e7342d39b4eabc96e84c4029e81d6ab88e4462fde5d47994c3c03a9679b25b8fe5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 36291493142d788de817eb559c4e0279646eaf22f3db849186bf52df776d7608
MD5 98faa9f6129d33512080473d1aafc2bc
SHA1 97519bd002ae3a9af8520c1219c52ab4193ab82f
SHA512 2135e6c7d0a59c170b177b9689035c0c8acb1003932049c0af971613a08b0b8de2e07008358479292e002b565cb4f2d72f622824c26741d69086a32a1c3051f6
MD5 SHA1 SHA512

Submit Download

svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCBCAAABBACCAABABCCACAACBCABBCABCCABCBBAABBAACABCBAC.exe
Size 2.3MB
SHA256 0f9e4cf59b9e642edac0bf5f8dcb440d176da40f6b648e5ad1d7ad426d5e423c
MD5 b9a1b1c079aba5373682b7dbff6b4b7b
SHA1 4888ad045c0605012db34c0c2d31e7b203f74ab2
SHA512 f62c897adab4056752b3b7872109b117fd706234ad9ef16597c8e37cd30682460eaa5ff56bf5a55792c767329cf6917933874d242dd82ad1d41c33a2bff603ed
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbWiw2EDd79WCh:T7pW7pW7pGp7H
TLSH
T1E1B55C01B7E99034F5F32B319EBA92658A7ABC619F35C68F6384461D0D71AD0E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 8eab863f4caccaa5f3ee78498d504b14b5451ead5b3d82eb2924aed166a36994
MD5 8a1dce864382efeb53e7c7fc3e974f28
SHA1 39fc49e18e41200c1188a69de6a82afb88ff8acd
SHA512 7dbeec42ef90f6da94bc26f966e293bec639076d0e87d20de40983f4d3f2aa96d4842c4a05bb6103209d4949e7f2a35979505376e69e39e6e5c99a0c08f90459
TLSH
T11F11DD61D4B9CC37A922A88F662DDB630CF4369BAC9C6E20A3118118FB85C30DD564E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1308-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/1308-8-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/2416-34-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/5256-65-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download