2193ce838ace1be19af33d44b6d79ab6cd31f6d99dc12e485d15b3678e79b9c2

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
Size 4.0MB
Sample260909-t5tf7ayanf
SHA256 2193ce838ace1be19af33d44b6d79ab6cd31f6d99dc12e485d15b3678e79b9c2
MD5 8463e2588deb6c66b428872081e1b9f3
SHA1 2ea646efdd5c145458610cbbbcc4299c9a7fada2
SHA512 76e9f7c9b0ce4d3ba8c0d233e77d6d6bc36b5d4a3387aa12350fe5b312b338a61eacd236217f8485e4996f89f584ab5b913549afb6d1057cafc49833c99d78b7
SSDEEP 49152:U+ES+EVCgM+ES+EVCgM+ES+EVCgM+ES+EVCgQ+ES+EVCgM+ES+EVCgM+ES+EVCgf:qhhhdhhhu7p8Q
TLSH
T105161905A7EA1074F5B356709CB682B94931BD21CB32CAEFA2449A4D6E72BD0DD34733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
3268	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
4168	svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBAACCCBCAABCAAACCBAAABCACABABCBABBBBCBABAAAACBABBACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe"	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACAACCCCBBCCCAACABACCBABAABCCCBABBABBBCAAABBCBCCAACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe"	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3868	sc.exe
4604	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1672	cmd.exe
4928	cmd.exe
5336	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
4168	svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe
4168	svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
Token: SeDebugPrivilege	3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
Token: SeDebugPrivilege	4168	svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1672	984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe	92
PID 1672 wrote to memory of 2748	1672	cmd.exe	94
PID 984 wrote to memory of 4928	984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe	95
PID 4928 wrote to memory of 4604	4928	cmd.exe	97
PID 984 wrote to memory of 5336	984	2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe	98
PID 3236 wrote to memory of 4864	3236	svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe	100
PID 5336 wrote to memory of 3868	5336	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_8463e2588deb6c66b428872081e1b9f3_elex_hawkeye_icedid_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABAACABCABAABCAABCBABBCABACCCABCACACACACCBCABCBCBCCACACABBAABBABBCBAACBBABCBBABBABCBACAABABCBCAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCABABAACABCABAABCAABCBABBCABACCCABCACACACACCBCABCBCBCCACACABBAABBABBCBAACBBABCBBABBABCBACAABABCBCAAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe" start= auto displayName= "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe" start= auto displayName= "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBCCACCACCCACAAAAABACACBCCAABBBBCCCCABBBBBCBBBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
1⤵
- Executes dropped EXE
PID:3268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCBCBAABACCBBABABBCCABBBCAACCAABBBBABBCAAACCCACBCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 077093a76e7559302494ae1a3791190115eefe3af92cb693c88d3810bbe8a97a
MD5 f2d646631f9292a1e922a03cafb32451
SHA1 b814eddd15f48df0ea5d41d085dd2ac8fff05393
SHA512 858abb4282c4170e3b448255507ff86e163a057e3e97f6a505526036ecc0aa6e8220eab707037f6bcc372da5becc5d64b95c166b77d7a09341ec95f380522daf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88ccc41c528f6ee2b45e4b76f07d64061f516078f16050a13201f7d6b9b3d242
MD5 f9c1d7cdd0dc8314fec8418c435a3c80
SHA1 4051e57e48233a898afe47aec7e3d6f15c282642
SHA512 2cf9c5cb1ef629f84702712894f5f7eeaa46337e89d6b858d94fdb851261933265204fc8cc163047dcfa0be21204b1f82d806f67521a2e52cd92b435911dee1b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9835d183524bb14a5fb5ca37141d9af1a0ec655e38c8a42c761ec06a461fc1d6
MD5 7f2648bd054de3b185812234cd162d7b
SHA1 1836eb7fbb129da262d1ee01358c57e6fe3b7492
SHA512 0299aae36418e59e3ee062ffa41c319d99796fa215e14c1f03f2c78fc467591d2ad38fa9a84eda8b0fc440d59a0a14ffb41965ce589c44f999152bed7456a701
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4bcc61cbe545c364a96fc201b5e526c94dcf5a34c1e7988c5609fc4214179dab
MD5 856c934bbd923fd742145aef8c82a34b
SHA1 843a186091738aeb6250339f4c6d8c5c1e98a532
SHA512 f9345623481416c3710a209be2cdf25e9a0214e90227494b3b3229f9a114a65cf7213f71969ffbdf4d33b83c3266173469b96d6b52762d20efe0697875660429
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 45d1e16ddcd1214972937121c38a9ab9f7ef1c39101c8dcd9327e2aa207ded00
MD5 fe01ea055910cb9a0b84b0b5b0942d40
SHA1 d1553fe2268d65400aa302e5f9d6b8f5543caccc
SHA512 0ae1f0b197b84c81806ed139e88f030bb998f137c53950210701cdbd96cc945e6ce67f80ce8d21626c39f9d04d881d97e7ef69a9921a80ef2ee0b9ea9bcded3b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f591ca75245102a06c3d6b345c8848340578eec506e930d91b5bd479efcf9464
MD5 dd83db3c16994601b072011ff74b03f6
SHA1 990b074e928f733f8fed47b77f7f9dca9babfb87
SHA512 29d06539c2a6707a99f022a9448e97349bb3141d2f6c8a16729eb3269cc948cc41fbb43abb9526eb00a065bf3d6e6b6ff28737d2464e124176d206aaec103d78
MD5 SHA1 SHA512

Submit Download

svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCACCBBCAACCACABBACAACCCAABCBCCBACACBBAACBBABCBAABA.exe
Size 4.0MB
SHA256 2193ce838ace1be19af33d44b6d79ab6cd31f6d99dc12e485d15b3678e79b9c2
MD5 8463e2588deb6c66b428872081e1b9f3
SHA1 2ea646efdd5c145458610cbbbcc4299c9a7fada2
SHA512 76e9f7c9b0ce4d3ba8c0d233e77d6d6bc36b5d4a3387aa12350fe5b312b338a61eacd236217f8485e4996f89f584ab5b913549afb6d1057cafc49833c99d78b7
SSDEEP 49152:U+ES+EVCgM+ES+EVCgM+ES+EVCgM+ES+EVCgQ+ES+EVCgM+ES+EVCgM+ES+EVCgf:qhhhdhhhu7p8Q
TLSH
T105161905A7EA1074F5B356709CB682B94931BD21CB32CAEFA2449A4D6E72BD0DD34733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7130ace0864ca3b6b3ba25f8e08f8f6d9a8f761748f40a31d917ac4cc29adb59
MD5 15eff743d2a4740e7349adeecddbeca2
SHA1 6574de8d403017ff91ddde61599fbbd764c86305
SHA512 1a5380e5934cb3ec3ae77f093714687194f9db96a3df097280cd8df197c17f8ecc925a24a159651dd8e8885d50f9f0b2981e2ee0fa0a0a764f043fc2e0caf8eb
TLSH
T13311E751F1B5D4A3F132ECD7613D8A8F0CD53BEE5858AF282309A6197B898394D1D8E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/984-6-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/3236-35-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/3236-22-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/3268-66-0x0000000000FE0000-0x0000000001001000-memory.dmp

Download

memory/4168-81-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download