7b188fc542c107b76f6762511acf5b6ee8c7aceb64409ca8c4d487a955e1f5e1

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
Size 1.7MB
Sample260815-b44awsxtdw
SHA256 7b188fc542c107b76f6762511acf5b6ee8c7aceb64409ca8c4d487a955e1f5e1
MD5 29f4248a5649e9bb73ece3508d3f5025
SHA1 26461397125278f92459dca65dfa9d42d121ec31
SHA512 cdfaf078f79d5c08b03f63e9d9c2d262b600f3c65c4da49dd5b4885a9a3b7cda17151a0925653ada727f0138863a31826aa7950b9d4ed1e32b8905394f9de3f3
SSDEEP 24576:m9+EM0q9+EMCCd4Kplki9+EM0q9+EMCCd4KplkiafDd70iTWCt:U+ES+EeXpH+ES+EeXp4Dd79WCt
TLSH
T138858C12B7C14031F5A301714DAF93BA452ABC215F718ACBE7C8722EAE71FD1A934766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
5852	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
2936	svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBABACBCAABACCCBBCACAACBCBACAACCACCCBCAACAACCCCBABAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe"	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAABBCABCACCCACACACCAABCCBBCCCBABAABBAABCACACBABABCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe"	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1036	sc.exe
2300	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
600	cmd.exe
3800	cmd.exe
4672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
2936	svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe
2936	svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
Token: SeDebugPrivilege	6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
Token: SeDebugPrivilege	2936	svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 600	3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe	93
PID 600 wrote to memory of 2564	600	cmd.exe	95
PID 3148 wrote to memory of 3800	3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe	96
PID 3800 wrote to memory of 1036	3800	cmd.exe	98
PID 3148 wrote to memory of 4672	3148	2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe	99
PID 4672 wrote to memory of 2300	4672	cmd.exe	101
PID 6072 wrote to memory of 4528	6072	svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_29f4248a5649e9bb73ece3508d3f5025_amadey_elex_stop.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCCBAACCAABBBBCBCBCCBBACACCACBCBABCBCCCBCABAACBCBACAACCACBBCCBACBCBCCBBAABABCBCAABACABACBBCBBCCBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABCCBAACCAABBBBCBCBCCBBACACCACBCBABCBCCCBCABAACBCBACAACCACBBCCBACBCBCCBBAABABCBCAABACABACBBCBBCCBACCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe" start= auto displayName= "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe" start= auto displayName= "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBBCAAAACCBBCBAACABBBBBAACCCCCABCCBBAACBBCBACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2300

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
1⤵
- Executes dropped EXE
PID:5852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABAAAACCBCABACBBACCCACCACACBACBAACBCCABCCBACBCACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a8ee421571f55041083edbf39b6cd51d514638b68ac7cef74adbc13771cf9d6
MD5 d8bf4ac2612822625fe65179a639980a
SHA1 17c6e0fba841f328461046d0c4f6670ef5a2abc6
SHA512 8bde7b3a4b1452f1e19cda5333b03d7eddc43095b14519df3491553a5d1c88ea1f44e3f150e74b887441f08e88802c994d8e919255cd42cf3f20008a633c7802
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3ac1dce4d6e5601fb645e79885134e8e3c221a9d66ac3ad040b1abf21667aaf
MD5 3c97710ea07f27c73c81e50c2d0c0fa5
SHA1 a86d8c9df681775899864c4538dfd8182bbb4a3f
SHA512 0d63d7ad02b23f8d47dbfbbe3e1ba7dc4ed2e8f4765ccb66f419629115beea2cbba0f7168df5cdda465366eabf0b26a91db1ae36912c0dbc7a3b9def95707fd2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9169ff666bc46005850b5e99bbb8f679bda403d9c9346e541bef31753fa7634
MD5 8140f43c7c7cd4e2ad891d21a38fd7b5
SHA1 900b4ba43f77710ac8c181f62be6962b5358034f
SHA512 0727cbb5f8701f8ecc41a2ff467c6cbd7254079184c8590c2bde78b2816ed76106b5eee775028ed2c580d694d181dd0c7a13e933e4812aa3b4e4c228f4918f20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4359e27e4f5a0ba9be730d9f3f8aac6d8705521463b57f6e67ee9dd6904f79af
MD5 5b2bf7d3b156b11921fdf6ae5d78da71
SHA1 61aedecc86df754cf1652e8a35f4e706cca01369
SHA512 e3f71086ca3da99eacf4df457c99ae1aca014c23389f3916c207129c13dcbbc6d5b43a83126bff89d90ff5039fb3c4d42159399c6a228631301111baa3b8bc8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7c5e76941c3b4c891e411b919441815fb8cbff92dfe0eb606648be0f2a109bf
MD5 8740cca5ff659195dc9fa85d2483b2a8
SHA1 1d8695c9d78d0af42f44e5b5be654f59a0fcda41
SHA512 82e8a1c725f3848034b545c1124fb72b08988bb15d51aaa7c5df59c77c51c4877d5a1f84c99cdd30427c5e70fc8913f594614024401cb6e2599f974806e96279
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d5b06848cdae979ecea8cb73ef8c83213814deab8ca7e906a8f26ec578a3c027
MD5 cf6a892f2b53adaf6bf74662d1ad9aeb
SHA1 a45b2df6e6712e84fbb329601fa2eb9c5353e922
SHA512 f64ce60ffbb6a182710107d28e0f5f540f4cf52a08987dbd056f6c5cb93eed60ba7552c50311a861a6b3db62e7ab9c546f47ce479406af9d659a8ee700be1596
MD5 SHA1 SHA512

Submit Download

svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAAABCCCCBAAAACCBABCBACABBBACABBBBCBABCBBABBBACCACCAC.exe
Size 1.7MB
SHA256 7b188fc542c107b76f6762511acf5b6ee8c7aceb64409ca8c4d487a955e1f5e1
MD5 29f4248a5649e9bb73ece3508d3f5025
SHA1 26461397125278f92459dca65dfa9d42d121ec31
SHA512 cdfaf078f79d5c08b03f63e9d9c2d262b600f3c65c4da49dd5b4885a9a3b7cda17151a0925653ada727f0138863a31826aa7950b9d4ed1e32b8905394f9de3f3
SSDEEP 24576:m9+EM0q9+EMCCd4Kplki9+EM0q9+EMCCd4KplkiafDd70iTWCt:U+ES+EeXpH+ES+EeXp4Dd79WCt
TLSH
T138858C12B7C14031F5A301714DAF93BA452ABC215F718ACBE7C8722EAE71FD1A934766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 f05ff4e84f797f98577a66e61fdc9cde087c786e2008c75ff9b05ac6a48d4505
MD5 c38960161e51a9da2d6404ef0fecc7ef
SHA1 977fb35860a0b99f8d095da5465957bce99fe4cf
SHA512 6dc116897ad13187a58e1d72fa81fffe9ec81adedd07634dfb3f7ad3f0524dc5941037ac80c6200e0aa4318a24ad335f549c1580d7c80e55b2c88a65c9deebfc
TLSH
T188115E61E5E5DC23F9332CDFDD1EAA424CF43A9FA89C6E14220D5218A79DC329E154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2936-72-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3148-6-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/5852-66-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/6072-22-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/6072-35-0x0000000000770000-0x0000000000791000-memory.dmp

Download