03e69bb4c7867b73afacb52cdb5d10d8ee4dee795a93c91e34afe006aa67a9a2

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
Size 4.3MB
Sample260818-ancybsserh
SHA256 03e69bb4c7867b73afacb52cdb5d10d8ee4dee795a93c91e34afe006aa67a9a2
MD5 65e78cca2d29097c3c9ac7cbe04f1742
SHA1 e44f391d1e9cccb2987634d90226809ebaa78206
SHA512 1f57fd9e0ee6148bc9979a4502fa67b1ac12144e3e58a79d6bc5600ad5c4185c4818d4a8c2e319bda1e3b013839009d31d2e71638c88654880bdb6d5c23ee6d9
SSDEEP 49152:U+ES+ES+EyJC+ES+ES+ES+EyJZLZ5zot7UcV9CUh1N+lVHrjB+ES+ES+EyJC+ESt:uLZ1opDbSVHrjdLZ1opDbSVHrj/p7c
TLSH
T1E026AF11F5D140B1E5B311714DABD2759E79BE204731C9EFE3C8AA2E2E33AD0A936712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
2720	svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe
2340	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBCABCCCBBBACCCCBBBAACAACCCBCBBCACBCABCCACCBBCAAABCBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe"	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABCABBCBCCABCCCBBCCAABCBAACACBACBBCBABCAACBBCCCACABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe"	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4324	sc.exe
4480	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5824	cmd.exe
2408	cmd.exe
4424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
2720	svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe
2720	svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
Token: SeDebugPrivilege	2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
Token: SeDebugPrivilege	2720	svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 5824	3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe	92
PID 5824 wrote to memory of 848	5824	cmd.exe	94
PID 2872 wrote to memory of 4676	2872	svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe	95
PID 3316 wrote to memory of 2408	3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe	98
PID 2408 wrote to memory of 4324	2408	cmd.exe	100
PID 3316 wrote to memory of 4424	3316	2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe	101
PID 4424 wrote to memory of 4480	4424	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_65e78cca2d29097c3c9ac7cbe04f1742_amadey_coinminer_elex_luca-stealer_njrat_remcos_rugmi_stop_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBBAABBCABBBABCCAACBABBBBCCACBCABCABACACAACBBACACBAACBBCBCCCCACAAACAACACABCCCCCBCBACABBAAACAACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBCBBAABBCABBBABCCAACBABBBBCCACBCABCABACACAACBBACACBAACBBCBCCCCACAAACAACACABCCCCCBCBACABBAAACAACBABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe" start= auto displayName= "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe" start= auto displayName= "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACCBACABBBABCACACABABBBCBABCABBAAAACBBBBCCACBBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4676

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBAACCABBCCBABBBBBCBCBBCBAAACCABCBCCACCCAABACBABCBABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
1⤵
- Executes dropped EXE
PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26f54392319ee27a536079a4421efbf6668e6fb6632e2c69363127c953fc9fdc
MD5 48b27526e6d1cc5db1348a3217c4d141
SHA1 333935ea9c9ec70fb37ea2a9e7a5bf4fe4e03233
SHA512 f945a71cfa4453f254aa70994b4554f9658d95d9c957a7abc7050aed145eaced155aac743296e85eb573f1140b05faaa4d294aad9d27b921b22b834c5316b0c4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 794c227c9ccca712a146dd0fe9d7c15fe35c231062a0a317d1904f11ee547599
MD5 2cd2374dd523f9e9478ecccfd90d2881
SHA1 f51673b8f18d1f1602ba7b7861afc795d40979bd
SHA512 373b839089198d12932ede1f8f824de3464a15b229981c4ff036397d8e5a4c614333b2a98cbb3da0fef1a469627dec2bf1c7bbd2fdd68100ac3f50c80b5faa56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3deffb0cc17e3c04c459c7f10160915c5c984ada9cf12e772963813d8a26edb1
MD5 8ba3d6e4bd7e7296bc98fda31d2df2bf
SHA1 4afa00399a0f6b37f0f493c0f945d0a9514480df
SHA512 c26288f7cda760ac5a99d16090c5c3b85acdcecc6ddfdb44ad115aaccde436b3016883139ed58d2c70e295271a87ddabe39c832b3b96d242c2043810950e9c2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 775df58b97658f430102baa818b579a2cf65a56159dbf9f6a9b4ffa04fb5453c
MD5 6827941dcf9c32b219f756345b8bf27c
SHA1 2e04cf0303718011ddc65e17ba1354379ce2f5ac
SHA512 48ab2e6903c01803e86337a391ecf053168577afd0246cbd77a813cfbc7c218d66c6fe662bac2494870051b94378a47c8a91b40489a1173e854c15c92d664000
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5abf18e836419f5472cf18a84d3981d3798482de132f4dcfa511c304cea19831
MD5 d01fb172bde8f6e34f9527a43c226d1b
SHA1 2084978ecb024c222ad52890c7a730f28ed07201
SHA512 74f9efed6beae5ef54464c814bb5796289b7b4cdbbae031e71e93adca15c18b6aee7f1cd39b5118ba47f73719968b287d2eca9b1e56a1358698be9effa19980f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c2c8543c793c19e8027a3690a5d7d7be9a65d94119b7e41f252293f53a988af0
MD5 28ea2e678d0df9f7d60aca9a87891a09
SHA1 9704194c2c69b1548c62dfbb53a3af2d5c04c2b4
SHA512 31b41c2101ebde157f41ad49c3ffec6257913c987291ac13730804d7379d2a4270860661808aa8362832218a166d8165ce578de2085570817007febe24a98734
MD5 SHA1 SHA512

Submit Download

svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAABACABABBCCABAAAAAABACCCBBABBBACACCAABABABBACACAA.exe
Size 4.3MB
SHA256 03e69bb4c7867b73afacb52cdb5d10d8ee4dee795a93c91e34afe006aa67a9a2
MD5 65e78cca2d29097c3c9ac7cbe04f1742
SHA1 e44f391d1e9cccb2987634d90226809ebaa78206
SHA512 1f57fd9e0ee6148bc9979a4502fa67b1ac12144e3e58a79d6bc5600ad5c4185c4818d4a8c2e319bda1e3b013839009d31d2e71638c88654880bdb6d5c23ee6d9
SSDEEP 49152:U+ES+ES+EyJC+ES+ES+ES+EyJZLZ5zot7UcV9CUh1N+lVHrjB+ES+ES+EyJC+ESt:uLZ1opDbSVHrjdLZ1opDbSVHrj/p7c
TLSH
T1E026AF11F5D140B1E5B311714DABD2759E79BE204731C9EFE3C8AA2E2E33AD0A936712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a0da69299fd0c28c69dfe4d0e5be007b9031fb8c4c536b1fb480f7eddff0e7ed
MD5 c4698a4707f45d5142259f5b7bb66897
SHA1 fe2d6096974cbf065e4df21215ea4d20c8a4ed6d
SHA512 ef139e2aeb4ff5b86ba4fa1efa9a5277c656a46860a86cb80b671fa4c558d791a9d825f8f57db0571e06b609b9f77cc26c5badd0a08a6db718ade8e251d52519
TLSH
T1C511EB71E4EADC3BF83369CFA22DEAC21CF837DB585C6A9413098118BB55C208D158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2340-81-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2720-79-0x0000000000600000-0x0000000000621000-memory.dmp

Download

memory/2872-23-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2872-34-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3316-7-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/3316-0-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download