83f1c19bdccdf9275c2a31557d920064c5c55a9fc9ae00d820a0986140c0f6d2

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
Size 5.0MB
Sample260811-d9s38avfle
SHA256 83f1c19bdccdf9275c2a31557d920064c5c55a9fc9ae00d820a0986140c0f6d2
MD5 1e953fba575bce1b68e70ce309782b20
SHA1 5f834b3d6c4a346cfcdcd40cdfd90d14acb9fa88
SHA512 c00f64c66d42ee921ccb891cd73998f208a9d07917787d0df218784045f333db17731e26ae00474830969e7e280ff767067b6786d43ac42cb3275e96de354fd7
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbR+EU4p67pbdE+EU4p67pbR+EU4p67pbR+c:T7pW7pW7pW7ppj7pW7pW7pW7ppD
TLSH
T1C4360701B7E99070F1B31B309EB592694A76BC61DD36CE4F63845E8DAAF1980D934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1992	svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe
3516	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCBACCBABCBAABABABBBCAACACCBCACACBBABBAABCACCCABACBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe"	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACCCCABABCBABCBBACCCBCBAABBBCACBBCBBAABBBBABACABABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe"	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5916	sc.exe
4672	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4440	cmd.exe
4760	cmd.exe
4780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1992	svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe
1992	svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
Token: SeDebugPrivilege	1992	svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 4440	5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe	92
PID 4440 wrote to memory of 4984	4440	cmd.exe	94
PID 1948 wrote to memory of 2952	1948	svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe	95
PID 5996 wrote to memory of 4760	5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe	98
PID 4760 wrote to memory of 5916	4760	cmd.exe	100
PID 5996 wrote to memory of 4780	5996	2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe	101
PID 4780 wrote to memory of 4672	4780	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1e953fba575bce1b68e70ce309782b20_elex_hawkeye_icedid_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBAACBCCBCBABBBACBBCCACCCCCBCCCCAACACAAACBCAABAAABAABCAABABBCBBACCCCBCBBAABCCAACAABCBAABAABABBCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACBBAACBCCBCBABBBACBBCCACCCCCBCCCCAACACAAACBCAABAAABAABCAABABBCBBACCCCBCBBAABCCAACAABCBAABAABABBCCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe" start= auto displayName= "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe" start= auto displayName= "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBACBACCBBCBACCBBCABAACCBAACAACCCACABAACACACACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACAAABAACBCABBBCCBBABCCBAAACBCAABCCBBACAABCBABACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
1⤵
- Executes dropped EXE
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 32a5935f4efefeb3b58414e6d999b17eb2d0ae0ede1b718275bd8b43a32597f3
MD5 49f5d4356d0d7af3633f17b83d4a5d57
SHA1 be45106fe3326e0db55e33a94216f50f5fa05a1f
SHA512 109a588ea2edcf1d9c9583d09ca93e1c70c32fcd61aa69ccc95e1729bcd0e549bcb6b2dafb563f16f03914e5978b7ce07661068e0a3fec06fc93e8c26c4068fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 110d763ae0d7031bd0d54822519cfd6b4e95476637186f4eb7b048b8eabea6ae
MD5 a31d0e68f11d6825cfee92bc548fc625
SHA1 64f6e282a9b54cdb09a95965f231032537a3fb76
SHA512 6a9822c9aa1f7b5acd2a0a6811630e39b23ef96ecf0cac0e7703ed6ad95d69c60be6769bd504b36af45a0ab0b1b5c520b5a47d81f9a363533c3ff35be690df7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3719ed6d567463f462593afdc8cfab9794ff5b5000f2e4df369389533e5b02c1
MD5 ed06064f5d95bc15294b9a9a5e51ef45
SHA1 550abcd86645a38a5030c965f8a4039f398281ab
SHA512 19144be38421a521be4f3e1c267ce0e8155316b785f1e02e50a792d30737205b3d93b4c5564ee2d5d8d12e6373b725ce9610c6d926da6743209847d4f8b4c2be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7988716f21299685980b6dd300148673a6e70fa0e96156f08d04361cbf4bacd7
MD5 33dc0dc77bcc2daebc73d46acb9d8d6b
SHA1 6aa1a391cf36205d492f7abed99d2f3219139801
SHA512 c14c4783ec1d48ec6ac80f9fcc18f768fc40082c9f55d28ce57820b443b001aed1db34c5cfc8cf54576cc37457a9b800fe8fadefd8eae418269aa1f1ab30de70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4cb449deda91b85369094319743f2a15c70331a409ce394b2d27115c219f5fd1
MD5 92e679a610ef66d3b30bf92e7ac5069d
SHA1 b8d53bd5f26e2fa0a77faa382e2dd957b9c48b30
SHA512 eaefea67f78bc28886f423e7b56d92357a7cc511ed869c3bf1dcfa4fb6e47e07cf0fd3c3bce4eac5d7303903c09b8f35cfce2148b6d0d98960222306104bc2a9
MD5 SHA1 SHA512

Submit Download

svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACACCBCACBABABBACAABBBBCBAACCCCCBBBACCBACBBBCCCCAAA.exe
Size 5.0MB
SHA256 83f1c19bdccdf9275c2a31557d920064c5c55a9fc9ae00d820a0986140c0f6d2
MD5 1e953fba575bce1b68e70ce309782b20
SHA1 5f834b3d6c4a346cfcdcd40cdfd90d14acb9fa88
SHA512 c00f64c66d42ee921ccb891cd73998f208a9d07917787d0df218784045f333db17731e26ae00474830969e7e280ff767067b6786d43ac42cb3275e96de354fd7
SSDEEP 49152:U+EU4p67pbR+EU4p67pbR+EU4p67pbR+EU4p67pbdE+EU4p67pbR+EU4p67pbR+c:T7pW7pW7pW7ppj7pW7pW7pW7ppD
TLSH
T1C4360701B7E99070F1B31B309EB592694A76BC61DD36CE4F63845E8DAAF1980D934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7efddaa51e174a37bcb689ae6656920e2463f6c0fb4f899260cccc3d86d2c1ed
MD5 0aeaf650de814b162e1c2723280b0a30
SHA1 a67bdbb26f7beb8faa1b1498acc7c1a01aaeb3bc
SHA512 a7e7a2718aa6b3260ae1629f84d2b30a875bb56039931c1fb9fd3d8f18b952007045852a4c72617cb0e596796282529ef8d7d396b603cc9a467f8a99ba65e11c
TLSH
T18011C461D4F5D863E9332CDBDE37EB830C903A9B68986B6423194218B799C329D194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1948-24-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/1948-34-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/1992-79-0x0000000000590000-0x00000000005B1000-memory.dmp

Download

memory/5996-0-0x00000000002E0000-0x0000000000301000-memory.dmp

Download

memory/5996-8-0x00000000002E0000-0x0000000000301000-memory.dmp

Download