Overview

overview

7

Static

static

5

2026-11-02...os.exe

windows10-2004-x64

7

2026-11-02...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 22:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
  • Size 4.4MB
  • Sample261102-193c8afx6l
  • SHA256 395ffc8fb33d7ac31a8193785c2850c9fa3cd482620c2c61e01df9f7d4af1e2d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_ce2af4412f0de69cb428c6fcc19ebf6d_agent-tesla_amadey_darkgate_elex_hawkeye_maze_nanocore-rat_remcos.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\wget.exe
      C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\wget.exe http://steamcommunity.com/sharedfiles/filedetails/changelog/NewModList
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:5596
    • C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.6.exe
      C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.6.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5052
    • C:\Users\Admin\AppData\Local\Temp\mcrcon.exe
      C:\Users\Admin\AppData\Local\Temp\mcrcon.exe -c -s -H 85.203.46.7 -P 25720 -p AdMiN_PaSsWoRd "broadcast (A1) Grid server status: CRASHED"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2816
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3220
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1984

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            NewModList[1].htm
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XDW2KZVM\NewModList[1].htm
            • Size 25KB
            • SHA256 36d37eef1595c482fae1c1dba27f9d07b68f79a2229a82d3fc97fccb7d8f9a55
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            !ServerSummary.txt
            • Path C:\Users\Admin\AppData\Local\Temp\!ServerSummary.txt
            • Size 1KB
            • SHA256 cef9c941bd25f8725070ce020948bc960b1032ec2cc8c100a34a41c191ccc785
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasModDownloader.zip
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasModDownloader.zip
            • Size 9.2MB
            • SHA256 d279324076b239ecf8875ca3bcee907f39a66fcf16334d2c3b6ff7f0fd712706
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtilityKeepAlive.ini
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive.ini
            • Size 485B
            • SHA256 66e0fc7352b17beba7698f84f4c0d271fa293aba6ae798df8dd4d5408b667e73
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtilityKeepAlive.ini
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive.ini
            • Size 1KB
            • SHA256 273c4000cb48b8069eb1d92d95c758620db926a35027295b46a6211c0a78e759
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtilityKeepAlive_v1.6.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.6.exe
            • Size 1006KB
            • SHA256 fbf1eb9c5e80689d80300d1237df74d88d1c0f9f48cd27d6ae07aa7e5f33f388
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtilityKeepAlive_v1.6.zip
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.6.zip
            • Size 586KB
            • SHA256 4007acb506319da6888e7c6ac191db7b6e55bc496073df093e30e74049871627
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.zip
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\7z.zip
            • Size 712KB
            • SHA256 efe810f9e3e63b337422312ecdcd21a902f628e665e52286e670ac17b4ac1d7a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtility_cfg.ini
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\AtlasServerUpdateUtility_cfg.ini
            • Size 211B
            • SHA256 21a9585d14cde4baf2e10cb9b96299a28a914a464da3421834192f27524464bf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtility_lastpidredis.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\AtlasServerUpdateUtility_lastpidredis.tmp
            • Size 1B
            • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
            • MD5 SHA1 SHA512
            Submit Download

            NewModList
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\NewModList
            • Size 25KB
            • SHA256 01f0f9d2cf51e273e879b2a946608c837c7cbdf52f17de8a466eea49317836c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ServerGrid.json
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\ServerGrid.json
            • Size 602B
            • SHA256 55533647627dba28506358333be9b859579129bf055f7ce47af14481b412ebbf
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            i_check_gray_left1.png
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_check_gray_left1.png
            • Size 36KB
            • SHA256 99e9d6a3394e825d8b25f6a46a436d3702c3e64c783a20f9171906b330caad86
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            i_check_green_left1.png
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_check_green_left1.png
            • Size 36KB
            • SHA256 edcc75237ac08fd416a89859515bec3311506e06d5029c834cad68989c87638b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            i_toggle_off_left0.png
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_toggle_off_left0.png
            • Size 57KB
            • SHA256 53f24c80c0b039e907dbb9cdcc1dc13a8e254b531ccf7c9320c46c0f1e0bdbf6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            i_toggle_on_left0.png
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_toggle_on_left0.png
            • Size 50KB
            • SHA256 328709999b1a02c50d1fbee62ec282ed39e752c6422fb3e09300ddd49efea191
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            redis-cli.zip
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\redis-cli.zip
            • Size 217KB
            • SHA256 188f7a5bd082064bc965d7681a9baebfdd247a419d12c9cf058a9330d28b7fa7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wget.exe
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\wget.exe
            • Size 4.2MB
            • SHA256 1908c52cc8b3f573c719451874b0cce62c89d965d733f403fc0e8f67480434fd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wget.zip
            • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\wget.zip
            • Size 1.9MB
            • SHA256 6d539c88438a430289dd7d2c10570294e2bc08169323f6b74bdf0a0be640819b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiscordSendWebhook.zip
            • Path C:\Users\Admin\AppData\Local\Temp\DiscordSendWebhook.zip
            • Size 5.8MB
            • SHA256 eeb59bb74460bd4fc07c0e8fe145ac4e974e5f747b2c4cfa322c09d34b01f76c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MainGUIData.txt
            • Path C:\Users\Admin\AppData\Local\Temp\ExportData\MainGUIData.txt
            • Size 82B
            • SHA256 f9ac3dfb98bed50504052363ebd72730cfb8d155f3c1dc8e03308f85238d80ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NetworkConnectionsViewer.zip
            • Path C:\Users\Admin\AppData\Local\Temp\NetworkConnectionsViewer.zip
            • Size 539KB
            • SHA256 a71c4a4f049cb4cadae4b54144b38b87e413af14236b6b32cd11091fdc68917c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamcmd.zip
            • Path C:\Users\Admin\AppData\Local\Temp\SteamCMD\steamcmd.zip
            • Size 756KB
            • SHA256 7669b170dee42db8ee2273775ed7dfb2d173bdba1b849f70d2c7b379290bce13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtility.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtility.ini
            • Size 20KB
            • SHA256 987c0ebd88a6fd450659464e00f72fabec55411aee778148b415ac71551bbdaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtility.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtility.ini
            • Size 723B
            • SHA256 011199e2a51e33dd218e2995ae9684fed5a03222579264eaf87c7a17468bbcbc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtility.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtility.ini
            • Size 2KB
            • SHA256 71682e3b7fcafa54429a370ec4047fd492296a7adf304d43cf54ecf9b780700a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtilityGridStartSelect.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtilityGridStartSelect.ini
            • Size 965B
            • SHA256 c23d31a8a53a1e8c186cb90c641400fe45cedd197b5ff8d9f937d6bb4eda64a4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtilityGridStartSelect.ini
            • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtilityGridStartSelect.ini
            • Size 966B
            • SHA256 7015cf7bb84a799564c3f64d23bab8fb8f35eeec31ee528579eeb68a5837ab89
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AtlasServerUpdateUtility_LogFull_2026-11-02.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_Log\AtlasServerUpdateUtility_LogFull_2026-11-02.txt
            • Size 4KB
            • SHA256 7e609497bf94d8a80441d03c1d3816579b61e3e7ce43fcfba85c6781c47c051b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AtlasServerUpdateUtility_Log_2026-11-02.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_Log\AtlasServerUpdateUtility_Log_2026-11-02.txt
            • Size 4KB
            • SHA256 256cdaef7f68db3ce5f9b32ed3f067c061a15a5b54fcf32ec1cdf00c9d59531d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mcrcon.exe
            • Path C:\Users\Admin\AppData\Local\Temp\mcrcon.exe
            • Size 19KB
            • SHA256 2bbe34b0d6ac2c44ade7ebbf1ee5d749f45c5610d88b456575b78e686a706794
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            mcrcon.zip
            • Path C:\Users\Admin\AppData\Local\Temp\mcrcon.zip
            • Size 9KB
            • SHA256 52248a0b4bda337d1d1304046a2b580d0fe23d13d76b73cbc989bd457c862bc1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2816-933-0x0000000000400000-0x000000000040F000-memory.dmp
            Download

            memory/2816-971-0x0000000000400000-0x000000000040F000-memory.dmp
            Download

            memory/5596-443-0x0000000000400000-0x0000000000844000-memory.dmp
            Download