4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Size 12.8MB
Sample260818-dh2laavcrc
SHA256 4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d
MD5 a8f7f03e32c7f01d844c7c5e02f69a8b
SHA1 afcb72f6598945fb80e7284130057be4e90d48cc
SHA512 7c36775629ff39a105aa2fabb6ab195159f98164870e5ea874a55d3702c66d3ab019f44296f1a55c8ab1b7286b9406d08441ff808fecfdfb22a00ea4b24cefd7
SSDEEP 98304:1LZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1oX:1LZvLZvLZvLZvLZvLZvLZvLZvLZvLZO
TLSH
T139D65C09F94340B2E96751B14DCFD27F8634BB2583128EFBFB8DCA1BB932A915839115
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
4944	svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe
5048	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACCCAACACBBAAAACBBACCBCBCCBCAACBAACCAAAABBCACBCAABAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe"	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAABABCCBCABCACCBCABACBCACCCBABABABBCCACBABACCACACCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe"	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5076	sc.exe
2868	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5032	cmd.exe
4612	cmd.exe
6076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
4944	svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe
4944	svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
Token: SeDebugPrivilege	4944	svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5032	4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	91
PID 5032 wrote to memory of 1120	5032	cmd.exe	93
PID 2368 wrote to memory of 1564	2368	svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe	94
PID 4264 wrote to memory of 4612	4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	97
PID 4612 wrote to memory of 5076	4612	cmd.exe	99
PID 4264 wrote to memory of 6076	4264	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	100
PID 6076 wrote to memory of 2868	6076	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCABACBCBAABABBABCBBBABACABACCACBCACABCBACBCAACABAABBBBAACBBBABBCAABCAABCABABCCABCAAABBBBAACBAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBCABACBCBAABABBABCBBBABACABACCACBCACABCBACBCAACABAABBBBAACBBBABBCAABCAABCABABCCABCAAABBBBAACBAACCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe" start= auto displayName= "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe" start= auto displayName= "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAAACCACCCBACAAABCABCCBABBAACABABCBBCBACAAAAACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBBBCBBABBCAACCCCAACAAACCBACCABACBCACAAABCAACBCBBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4944

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
1⤵
- Executes dropped EXE
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fee90721f60e94663611689474a7b4b71e4c3e732fda44f09ea227dda1e379b1
MD5 bd531f4455078a17213abfefc2bc42b2
SHA1 dafba3c42b202ecbdf49cb931f519f0f6935bb5f
SHA512 92601a18074c2e469d3f579a474edf188eac05c87ac268c4a00d2aacd600210ced72b9b2a5bc661703cb3f6984a28fd830425090d6d3be7d246affb229383ff9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6dcb43c0141304fcda1b210eef21691c8640e26e5291b4a90835d01d5f3b329a
MD5 3aa2d71b914d480123b0ce9275bbc197
SHA1 44e21ad95014360f4491b808dcfa6b155a8a9e64
SHA512 945eb4a4e7608cc6e6155cb341bba347417a842def8fc9f27e9b94d99712a13bb1e73c0f6788f041cf904edc834ac9185d9b9a9018599670d160ca7e5de4aae5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c937675f546fe69e659c89dd69d8e468f25b53eee4eaaa6f39175b37cb886cbc
MD5 b7d3a1852c0ed0415717df41d867f973
SHA1 bf512704e793bbb108671c79eb0917b0e54bc472
SHA512 d015ad699d3a175f1b30ae40f46396ef37582b159307180f6945271a3f76aae994c6473ccf75c9c18a38ab51a7cb67111bba764381ac1bbdc61fb9ccc6aa6428
MD5 SHA1 SHA512

Submit Download

SaveTest.exe

Path C:\Users\Admin\Downloads\SaveTest.exe
Size 640KB
SHA256 2bfb5ac191237d853b8b76f0caba717da340cf1d3cae4b4888c7aa59d9a6af3e
MD5 4cf39384701f32d0ee256527079b0543
SHA1 658d37fbd409f91941c9569466340c511081e2e2
SHA512 41ae4e77fa3cba48b7b57e213b3191d1554732e1bb0371c739d852fb293840c270c135ff3aa578958ae564521e088e63ae1e91f976659e6887520b5bb37b0f5f
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnojA9gUFgEsnU:m9+EM0q9+EM0q9+EM0q9+EM0q9+EM0qb
TLSH
T157D41A09FD4340B1D92B51B04DCFE3BF8A60AB25C6128DF7FB4ECB5BA523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SaveTest.exe

Path C:\Users\Admin\Downloads\SaveTest.exe
Size 51.8MB
SHA256 6b6af9236c4011086dd861c4ca83f303db70b81ca36148830cbce8d8f6050bd6
MD5 d39fc9e738524259890984bfbf85454d
SHA1 fc1e924445450d488ec30ee2fe816bbaf5c38e26
SHA512 db11b57532964860098635060901fdce155b19e5ca3fa946ce05303f5b05564e5ae39c8616530e508b87eb35f23666b8904f245442b92444cda913d1d81d600d
SSDEEP 786432:D111111111q111111111q111111111q111111111qf:Xf
TLSH
T17AC75C09F94340B2E96751B14DCFD27F8634BB2583128EFBFB8DCA1BB932A915839115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8fb341d6c2506a8e6fd219027debc46007d25f176d489ce07746751f38c986f9
MD5 a0ffe454f9b5c7fe277b9aba9e5ac186
SHA1 55329309611b59dadcd41fe6a6804634959e2056
SHA512 10415c107cb5f966207b70c679b61918fb4ecae699870dd63fdfcfd93052fdd143d0835aa7fb7ca671db27f75b41d0a0fe6e07d79a84640388cf0ee217017f3a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba4f479953389b64e998c4c8509981c25e6e7fa21e0ec9e7ea96438ba2f39793
MD5 cab18d1b8b3bad4227aa17cde03bdc92
SHA1 7d665031812f2968d2da601cd0955f5a456e6bf6
SHA512 4e56f6016d7bff1f972475fd2ffe6dc9fa8be3796720d152e991806c8e6aa6b0178459ee668cadf00e7acfeefe63e51e87aa9641db0ba1cdcb14c49b8c5cb7fa
MD5 SHA1 SHA512

Submit Download

svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBAAABCABCBBAABACCCBBCBCCAABAACBCCCBCBBCACCBBACCABBCCAB.exe
Size 12.8MB
SHA256 4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d
MD5 a8f7f03e32c7f01d844c7c5e02f69a8b
SHA1 afcb72f6598945fb80e7284130057be4e90d48cc
SHA512 7c36775629ff39a105aa2fabb6ab195159f98164870e5ea874a55d3702c66d3ab019f44296f1a55c8ab1b7286b9406d08441ff808fecfdfb22a00ea4b24cefd7
SSDEEP 98304:1LZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1oX:1LZvLZvLZvLZvLZvLZvLZvLZvLZvLZO
TLSH
T139D65C09F94340B2E96751B14DCFD27F8634BB2583128EFBFB8DCA1BB932A915839115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 dd832300606d45a83eec794dc0c2760e20090de87f06116e3889c3aef440cfa4
MD5 d7694c318805610314c96bcbfb26b6fe
SHA1 512d8b42e561582fe1137199e34c5577e4dc5f5a
SHA512 e824fb67e3cc7c8b594165a0ddcd7bbc0eae196d1f92ab0fe2972f8c87de2a8c76d7563641538a13b0e799e3ebfb5884a52fa01f81b9e0a0adac69e079c082c6
TLSH
T1C711CA50A5F6D823F9336DDB522DDBC30CFC36DFAD586A5813488218AB91C3ACE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2368-47-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2368-65-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2368-98-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4264-48-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4264-0-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4264-23-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4264-12-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4944-99-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download