9d541dd8b35be28577cfa5adc163080b6e4c3dfe23892ec7b30061c0cc37fb71

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
Size 13.0MB
Sample260810-fn2vcaeb89
SHA256 9d541dd8b35be28577cfa5adc163080b6e4c3dfe23892ec7b30061c0cc37fb71
MD5 423ed24dc0e15ca9fc483fe991fa0847
SHA1 8e674dd7e458b2b45ce5571bb5c4a6ef7158ca86
SHA512 a1b666a4770a3061868d0ba5cee5ccea3b2f14e42005f25575811544b1a97c6398afbfd60608cafc9b3b7d465a4637472dc503b8c9c5424d43b6a76189b4c1bb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp74p7Dp7Dp7Dp7Dp7Dp7Dp7Dp7V:vBBBBBBBBBBBBuBBBBBBBBBBBBb
TLSH
T13DD67B10B7C18035F5B329728ABFE739552CB9714F6986CFE388062E5D70AE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
808	svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe
3008	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABBBCCACBCABAAABACBCBBCACCCCBBBAAACCACACCCABAABBAACACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe"	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBCCBBAACBAAAABAABCCACBABACCCCBAABABACBCACCABBBACBCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe"	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3348	sc.exe
4884	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
1924	cmd.exe
2512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
808	svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe
808	svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
Token: SeDebugPrivilege	4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
Token: SeDebugPrivilege	808	svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
868	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4844	368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe	100
PID 4844 wrote to memory of 1576	4844	cmd.exe	102
PID 4080 wrote to memory of 4660	4080	svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe	103
PID 4660 wrote to memory of 2504	4660	notepad.exe	104
PID 368 wrote to memory of 1924	368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe	109
PID 1924 wrote to memory of 3348	1924	cmd.exe	111
PID 368 wrote to memory of 2512	368	2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe	112
PID 2512 wrote to memory of 4884	2512	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_423ed24dc0e15ca9fc483fe991fa0847_elex_hawkeye_remcos_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCBBABBCBCCBBBBABACBCCBCBACBCACBCBCCAAAACACABAACCBCCCBBBBCBACCBBAABACACBBCABCBBCCBABBBAAABACABCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAACCCCBBABBCBCCBBBBABACBCCBCBACBCACBCBCCAAAACACABAACCBCCCBBBBCBACCBBAABACACBBCABCBBCCBABBBAAABACABCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe" start= auto displayName= "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe" start= auto displayName= "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCCBBACBCCBABACAACCBCCBCCBBBCABACBBCBBAAABABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4884

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBABCCCAACCBAABBCBAAAAACBBCBCCCACCCCBBCBCBBBCBACAAACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
1⤵
- Executes dropped EXE
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7668405198b61cdcde8215b9e4926cceed05bb7b6861ddf7c7a4c5cfb4dacac
MD5 eea466d006ddca30ab49d4dc57d2a142
SHA1 e14d491845efbcd32a59eea8abab5e295e8c35b6
SHA512 563f3d7f5c8a318ce216f34db1fc5cdd9b5b6b954725863ca4b32d49af64ff4992afb9d1a4d8e2edce12865b38f9e7231240bb1fd6d7e87f606bfa6e78601d7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db435a1e7f7281f37f647f237874e6b6458f425fcb7898ac378a769bf66e2658
MD5 50e160a13cb9726750fd2223f62432a3
SHA1 821e9f952e3f87fcc0285769a0e4d620edaf1362
SHA512 5f1d5f49dcaec04b518f4f7e569b58cca904c77eec4c0df847703cd6ea7f48c9241708d5901ca2629625e26a2379341f50ad5df1c85324247b72791627be668c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6d3ae71d20c71417ef964a1b2530d6ada1a8290d8c02774519a63c0f36000df6
MD5 01f038dcffdcc8ce55ff8823e5a4f2ee
SHA1 e96ad5e7fc7ec60cbcdbc9baf382c6e6dc58d219
SHA512 a0713ef27c1facbde8b33a573839cf5559e15cea45678f9bcf629102e94cf9de9c94cda2983d46a3bc4966b9c980257a9757641512174d97cfa5cdfc56f2734a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0331b3a856dbb5aef6fbe7fa3289dafdde46e4ef45ac2a225b201e24d8ecd4f5
MD5 c27f83363e75c14f3ed06d8992cc38f2
SHA1 f636d65928cbd45df43657f600c05533af53b6e5
SHA512 5495b2acba954023e18bf7c1c76a501958be97111995216a761218100cdd6d826c77fdb6beb5ddaea4bbd11a16db1a356c8dbbd349457ea71f3b0d406e1c6df2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e0ef41ee5378c4744017e98bbd07d97666cd14794f011c2e28268cc3f777e532
MD5 9c2b478b692c4e28731bd107d37729f3
SHA1 9aeb81116298f51ccaf8efe3cb32e4a44a3784a4
SHA512 d858fc86c426a9bc5ab5ecfda50af3e40b2f36cd01e7bbdd1fed26e5b5728c63c225fbe56cf28c7869bd3d9dcbd97dc30c7240bc208c7af4fa7c88cd7c7064e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3de6662f21c75fe921814b997ecb550d9ab1a8b9761d125e3233e0416e11101c
MD5 7f499b355002f9d780de8dacb40e47a9
SHA1 276878de007523b641dc88cd2e18981403cad9af
SHA512 9a65d31bef181cb1fed086045b7332536ec2991ed92e58a147178c265127217e7eadd5fc837d208ad53622341fb30eb14f6a068309cd2e0f789fd4501ed1ee71
MD5 SHA1 SHA512

Submit Download

svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACABBABABBCBBCABAABABAACCCCCCCCCBCCCAAABCABCBCAAABCA.exe
Size 13.0MB
SHA256 9d541dd8b35be28577cfa5adc163080b6e4c3dfe23892ec7b30061c0cc37fb71
MD5 423ed24dc0e15ca9fc483fe991fa0847
SHA1 8e674dd7e458b2b45ce5571bb5c4a6ef7158ca86
SHA512 a1b666a4770a3061868d0ba5cee5ccea3b2f14e42005f25575811544b1a97c6398afbfd60608cafc9b3b7d465a4637472dc503b8c9c5424d43b6a76189b4c1bb
SSDEEP 98304:Jp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp7Dp74p7Dp7Dp7Dp7Dp7Dp7Dp7Dp7V:vBBBBBBBBBBBBuBBBBBBBBBBBBb
TLSH
T13DD67B10B7C18035F5B329728ABFE739552CB9714F6986CFE388062E5D70AE1A934727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 a0d473fb28fe8310ed8c3e17815e9556f88c1500ae18a3ca5fd9a431f97e13ba
MD5 9bfaade2416e730432822c2c44f41ced
SHA1 00231147fbbc7e8f9df2ff9148817005b74a3acd
SHA512 9dfc62a3b41d89ce2dfdc616206733d87dab57bbc740d0bbce7d0df8092d6702b1c6b722ac34714219d289ee027e046a57a5ec882323cc2a5a17d1719c0b8401
TLSH
T1C011E610F49AD863F97368CF97199BE30C9473CB78986A14230D8108EB8DC35CD478E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/368-0-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/368-8-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/808-87-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4080-37-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/4080-27-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download

memory/4660-59-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download