5d0c48666d45e68abea967bba2ad963de3f20feba7115e81b7d3fc21c586a90a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
Size 1.9MB
Sample260814-ejk6cstzdy
SHA256 5d0c48666d45e68abea967bba2ad963de3f20feba7115e81b7d3fc21c586a90a
MD5 81c8115f307787a965367983df4d0ad9
SHA1 de13adad6a377ac82ab1e0b42dfed6fd75846ed7
SHA512 7bcfb2e36dcaf53be37eada17d82230a1b98c8e7b84c4a050bc301a35d5f3bdf297969cd302546d23a5d1099846423c8c079c2a877d26e2b9ee7dde7a53ce39a
SSDEEP 49152:U+ES+Ek+LgVLKR++ES+Ek+LgVLKRV4p67pbJ:+nKRMnKRF7pt
TLSH
T113955B02F6C540B1E5B229304A66A27D5B79BD21C9338E4F63845DDEFFF1A809D28736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
1672	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
5216	svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBBBCCABBBCABBCBACCCBBCABACABCACABCBBCCBBBBABBABCACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe"	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCBAAAABCBCCABABCCCABAABBAABAACBBACBCACAABAAACBAAACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe"	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4272	sc.exe
5776	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4168	cmd.exe
6136	cmd.exe
5864	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
5216	svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe
5216	svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
Token: SeDebugPrivilege	2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
Token: SeDebugPrivilege	5216	svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4168	5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe	91
PID 4168 wrote to memory of 5976	4168	cmd.exe	93
PID 5000 wrote to memory of 6136	5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe	94
PID 6136 wrote to memory of 4272	6136	cmd.exe	96
PID 5000 wrote to memory of 5864	5000	2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe	97
PID 5864 wrote to memory of 5776	5864	cmd.exe	99
PID 2700 wrote to memory of 4112	2700	svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_81c8115f307787a965367983df4d0ad9_elex_hawkeye_icedid_remcos.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAABCBACBCAABBACCCABACCCAACBBCCCABBCCCCCCBCAACAABBCAABBBBCCBCBCABAABABBACCBCBBAAABACABCBCCABCABCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAABCBACBCAABBACCCABACCCAACBBCCCABBCCCCCCBCAACAABBCAABBBBCCBCBCABAABABBACCBCBBAAABACABCBCCABCABCACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe" start= auto displayName= "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe" start= auto displayName= "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACAAABBBBACCBAAACBBACCCBBBBBCCACBCAACAACACBACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBCBACCACCCAABBBACBABACBCAABABABCABBACACBCBBCBAABCBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9dede17e2a119672ab77308402c5474ddc6e388bdb74d9f648822615620abd51
MD5 ff6fe5937ea3e4e84c70f9f7eda6435c
SHA1 a1f2be7954266e3893d6754a665dd6f3ff832c02
SHA512 2f5cb787fb84959722f90d77f737acc6b1185819835bc00fe45537ab39e2f7edd714309a3e3f18545707418fb5ec007550896b01bb6050d1ba803bf2d7202bee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d5e4d12713f041e3f735f09ce26bf3accbd269b903441b8e6254baa6b234e42
MD5 365d7ba7ba2ee994f72b28a5612c784f
SHA1 f1599ac63b22c5ee03eecdb2c31b9eb4c458f1f7
SHA512 f3ee88b67cf4308b4c51e881462413bfe01db63618bbedd4d314d5b15b62c1227756158bd11c8bf285605ed5710399ba6f5a12121410291db874f06dfc5f8d35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c7e84db719a2a5c20d5ca46997c92e974a73aa401f9dd600ba07edf252af8ce4
MD5 63dc9c77cdb7b1a3477102f65d47054b
SHA1 4ba3ad818b1f6e6766def623084f39683be53c4b
SHA512 e37ef00c960f0554f27318b7924275f2bc7ef34a7236b7a2d53d42cbeded5892f091802ea1a0e332d1c513a92a2f263ff4890820fc5816e465d2d56acf356551
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4561f7d364c3d26d79fc79acc6f399c52ad6b73b4e382d738a0f5099030a5ef6
MD5 920544f62881ea212b230979f5b25715
SHA1 4e01d956b533cf9338395af5c1b04b47ff116b65
SHA512 5006a3af6da6dd919effb5d50fa369e81671f5d3b21dba2d7d5f80b59d45233581adf37ba11e7cf09d801414894558d6715aef22cfec831b0abb3e39220e58cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b44053702f7bec051d083f3dd8b3c617b948d8e6e217e09796f0fb1e8d6de3f
MD5 c4b6bb7ddc33ceef4737e86f23c1aae4
SHA1 f8d525074c029aa53284a73fc4a0bde9b31d4ae1
SHA512 d72d6de179b80d0deedb8d482590d949e861bc7d80e0d0258ec65bcff2e37357e77e53d9eaab4222be067c91a165d1c0fe4ac9467f55ac79d3df3234f8173d49
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0732df78655092f6f1851b996a10a05a5d138c648e26346acaa37e71735a08e9
MD5 610b7a5d16bfac4f9ed8b9f109fd5470
SHA1 9ca8a99f863df544624bd16c2de3fac1d7adcda9
SHA512 83b4b117b135a6647c462b8d243d1b13215cbf688d1c38d1c0eaec4491d629e8cf3eb45cc1cb2f1ba32c05352d67f749645ad44bf85dafceaec24e593a4ce684
MD5 SHA1 SHA512

Submit Download

svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCAAACCBABBACBCBACBBCCCCAABBABACACCABACBCCACBCCCBCBA.exe
Size 1.9MB
SHA256 5d0c48666d45e68abea967bba2ad963de3f20feba7115e81b7d3fc21c586a90a
MD5 81c8115f307787a965367983df4d0ad9
SHA1 de13adad6a377ac82ab1e0b42dfed6fd75846ed7
SHA512 7bcfb2e36dcaf53be37eada17d82230a1b98c8e7b84c4a050bc301a35d5f3bdf297969cd302546d23a5d1099846423c8c079c2a877d26e2b9ee7dde7a53ce39a
SSDEEP 49152:U+ES+Ek+LgVLKR++ES+Ek+LgVLKRV4p67pbJ:+nKRMnKRF7pt
TLSH
T113955B02F6C540B1E5B229304A66A27D5B79BD21C9338E4F63845DDEFFF1A809D28736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6fd619f05c961c2cb887ec09e6d1475b7dac4521795773a0f87d3deabb75e89b
MD5 e5a84367c9bc3504be9a9939d34ba47b
SHA1 9b1dfe1d9c81960622acdc8361d6e91bdedc488a
SHA512 bbf622f06f0262111eaeb0850edd3b7777fcc9c758d740e2de48c643ef145a6e047da78809bb310edfd20b73341d50dbfae9c3298f965b2e93cc98ce89001801
TLSH
T13111385298F0CCA3E83268DFA11DAF830CB0B687289C6B54130D4228FB8DC355D554D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-66-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/2700-35-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/2700-22-0x0000000000070000-0x0000000000091000-memory.dmp

Download

memory/5000-6-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/5216-72-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download