8cfee47dc4f2c3fc9acb10c615606f63d4ebe97082e9f53f625b5b25ad167541

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
Size 1.1MB
Sample260814-e8k7navdje
SHA256 8cfee47dc4f2c3fc9acb10c615606f63d4ebe97082e9f53f625b5b25ad167541
MD5 4646102b1202da1e0226b0d4cf2b8c15
SHA1 71954a23651fde81cc74a22fdb298f9ef693ba94
SHA512 1b29788e7856d54372c277e8988d26801e411c339775745680e45be5a91d81a96227139695170beb60667933e1c4fe77bd334933b8db4e7f76f13e3ec906211a
SSDEEP 24576:m9+EM0l2slZOZc9+EM0l2slZOZF49H67pbz:U+E1B+E1Q4p67pbz
TLSH
T1D3456C02B3E554B4F6B34B308E7A9175DBB6BD625D30CB4F6394460E1E32A50ED39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
4260	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
7144	svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCCBABBCBCBABABBBACBBCABAAAAACCCCACCBAABBABCCBACCCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe"	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACCACCCCBBAACBCACBBAAAACACABCACBBCBABABAABBAAAAAABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe"	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4212	sc.exe
3784	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5020	cmd.exe
2684	cmd.exe
2220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
7144	svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe
7144	svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
Token: SeDebugPrivilege	4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
Token: SeDebugPrivilege	7144	svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6620 wrote to memory of 5020	6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe	93
PID 5020 wrote to memory of 4868	5020	cmd.exe	95
PID 4824 wrote to memory of 2572	4824	svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe	96
PID 6620 wrote to memory of 2684	6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe	97
PID 2684 wrote to memory of 4212	2684	cmd.exe	99
PID 6620 wrote to memory of 2220	6620	2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe	100
PID 2220 wrote to memory of 3784	2220	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4646102b1202da1e0226b0d4cf2b8c15_elex_hawkeye_icedid_njrat_remcos.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCABAACBAACABACACACABABBBBBCABBBBBBCAABBBBBCCCBAABABCCABCABACACCACBABACCBAAACACABBBCBACCBACACBACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCABAACBAACABACACACABABBBBBCABBBBBBCAABBBBBCCCBAABABCCABCABACACCACBABACCBAAACACABBBCBACCBACACBACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe" start= auto displayName= "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe" start= auto displayName= "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBACCBAAABBCCBBBBACAABCCACBBCCCCBBABBBCABCCCACCCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABABBCAABBBCBBBAACCAACACBABCBABAACACCCCACCBCAAABAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ddf7816f797b10652d38fbae88cdf0ac6275910789029c8d937c852f16d8cbf
MD5 b3db9dd5b263e4c82703e2716f6ebb8a
SHA1 4d75c7a294ff05e2ba4a0cd2debd9f383a6dd530
SHA512 99cce46804fdbced5773511db84dcf74a16978a96a49afcc80fbb22f05b6e7d14d713a62a102be00fb5f4f85abca995b73780d7ce4935240927fc456759e40fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e4639cca3cd043b9f814023a65dd5335f6d4d8682d1314ed2dfdba7217218e6
MD5 369cee80afc9bab754ee5275333eb36a
SHA1 c6ea3f30dcfd2294707138fa2b98548aa067c5ea
SHA512 c9c832d29d614ecf62a269a7ee7e7fd00ae8c5411ae4150f4bdd1026cd8483bd065843d0a1e43a013477a0336f216922c2fe193865c39475e82805c41ab8e791
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b8de31c13c32117a0cc875748c745307f159d237a6f31c59d48a676e99f0cda
MD5 fea47e28b35106dc362f3c297d3f33f5
SHA1 58eeb7e1f020eaf32b19496fa5f1d836bf805ea0
SHA512 a5aa1a21489b717efc945eda43f82023df1fef0d578ff7ef69a11d0763886d03146a3ee3786230de6bd482f9004898c8b4c9937ef9ba12aa96f66c252e424bd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ec2031e192a9374af44f1f4fc808278d063a99bd521ced9438f4d500cfc6a1c4
MD5 92ec5df29269cec28dba6dba0ba94f39
SHA1 84ad2af4fed4b14f28e3e2a0244424465458b2a6
SHA512 23679f85016813e4f27a37c569d132151c260f179b2c78b2f0105995338253ca6535f26fd5a389c46522845398989c97ab10b201deb1b899e06b2e5ce6375248
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0b1d947aae754f00740ee20b9773e1af2aadccf69b65cd8f7423be27713169f
MD5 6990a2c326dc862356f1ff7c221ef515
SHA1 dcd48d40927c8a985090102931da1ef6e988a07b
SHA512 893a76f5f23d6c0720ca90471e920ad32f685028aef0d9d2605ce79716e34b159219a37ecb6b68d92a161927628f1d54ababfc6588f00bffaae9ae41251c8190
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cc5979a8ade345217c14a538b9fde273be7c667f8d61507ea11e3bd722700448
MD5 38575ac401f9002b007aa72f3ccff9f4
SHA1 65af59e933204756a8728657006c5a47fc7be347
SHA512 08176aaa2fcdd0e191710cb7611ded19ab1e8da4d3df3b3a14e6f0c0cf03aaad10c85acb67b1f962a953fdf0f57015480ebaf9bed4f4a304463ca8e97ccde93f
MD5 SHA1 SHA512

Submit Download

svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAAABAAABCCABCCBCBAACCBBABBAABCBCCCBBBABCABBBCBBABBCB.exe
Size 1.1MB
SHA256 8cfee47dc4f2c3fc9acb10c615606f63d4ebe97082e9f53f625b5b25ad167541
MD5 4646102b1202da1e0226b0d4cf2b8c15
SHA1 71954a23651fde81cc74a22fdb298f9ef693ba94
SHA512 1b29788e7856d54372c277e8988d26801e411c339775745680e45be5a91d81a96227139695170beb60667933e1c4fe77bd334933b8db4e7f76f13e3ec906211a
SSDEEP 24576:m9+EM0l2slZOZc9+EM0l2slZOZF49H67pbz:U+E1B+E1Q4p67pbz
TLSH
T1D3456C02B3E554B4F6B34B308E7A9175DBB6BD625D30CB4F6394460E1E32A50ED39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 87e64b2dc6858c05b531111ce759c322a6f89f3ead645435f6a36dcdbcfc83db
MD5 b268519a2eed91294c669a712f8292c6
SHA1 9e21bef40c0e10801e57c674599f0d0752de0dbe
SHA512 3a69dcad461e8ad8bc1acf7271dea5833d23dfeeeda207dea10f8432eaf7dce564745f0b7bba229e8b416d96d4a26019a121a653734220429382c3961d326e04
TLSH
T16F112B71E8F5C833FE33B88F561A8BC228F4778FAD18BA4413064129AADDD208D550B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4260-66-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4824-22-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4824-35-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/6620-6-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/7144-81-0x0000000000F60000-0x0000000000F81000-memory.dmp

Download