Overview

overview

7

Static

static

5

2026-11-02...os.exe

windows10-2004-x64

7

2026-11-02...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_ccdedf12303d81db506ac9768de41770_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
  • Size 4.4MB
  • Sample261102-2e37pszw8m
  • SHA256 186189c0721840334eaaee8c042b79337dbfeaae8bf1384ac7914919c42c11a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_ccdedf12303d81db506ac9768de41770_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_ccdedf12303d81db506ac9768de41770_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.5.exe
      C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.5.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5444
    • C:\Users\Admin\AppData\Local\Temp\mcrcon.exe
      C:\Users\Admin\AppData\Local\Temp\mcrcon.exe -c -s -H 85.203.46.7 -P 25720 -p AdMiN_PaSsWoRd "broadcast (A1) Grid server status: CRASHED"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1716
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:1520
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1944
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:560

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              AtlasModDownloader.zip
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasModDownloader.zip
              • Size 9.2MB
              • SHA256 d279324076b239ecf8875ca3bcee907f39a66fcf16334d2c3b6ff7f0fd712706
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtilityKeepAlive.ini
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive.ini
              • Size 485B
              • SHA256 08bbe0ceebe80d9edbe2bad80b16da8d444ecb63d5fca47eb6e7556259428843
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtilityKeepAlive.ini
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive.ini
              • Size 1KB
              • SHA256 ea1e90e255bfe76db365d87c7e25a01e36330f81f8ed60da719fe92fffb3a61e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtilityKeepAlive.ini
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive.ini
              • Size 1KB
              • SHA256 f1c60140e53f7a4111e83e0f0b2562839d67a1038ae7e383246a85725d63560b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtilityKeepAlive_v1.5.exe
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.5.exe
              • Size 1005KB
              • SHA256 62efbb5873047547a46ec3c972cdfb2180e7f21b267ead927b4e8ff5767db5ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtilityKeepAlive_v1.5.zip
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasServerUpdateUtilityKeepAlive_v1.5.zip
              • Size 585KB
              • SHA256 bc57ea9046bdeaa0f671389dbf91945a94c3c3f7d10fcfcbfdd54e7ba24ed1bc
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              7z.zip
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\7z.zip
              • Size 712KB
              • SHA256 efe810f9e3e63b337422312ecdcd21a902f628e665e52286e670ac17b4ac1d7a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtility_cfg.ini
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\AtlasServerUpdateUtility_cfg.ini
              • Size 211B
              • SHA256 339d59bd99f663b6bff37aad5507c7c6b485cd67985d78e39639b0da579496fe
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtility_lastpidredis.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\AtlasServerUpdateUtility_lastpidredis.tmp
              • Size 1B
              • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
              • MD5 SHA1 SHA512
              Submit Download

              ServerGrid.json
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\ServerGrid.json
              • Size 602B
              • SHA256 55533647627dba28506358333be9b859579129bf055f7ce47af14481b412ebbf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              i_check_gray_left1.png
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_check_gray_left1.png
              • Size 36KB
              • SHA256 99e9d6a3394e825d8b25f6a46a436d3702c3e64c783a20f9171906b330caad86
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              i_check_green_left1.png
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_check_green_left1.png
              • Size 36KB
              • SHA256 edcc75237ac08fd416a89859515bec3311506e06d5029c834cad68989c87638b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              i_toggle_off_left0.png
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_toggle_off_left0.png
              • Size 57KB
              • SHA256 53f24c80c0b039e907dbb9cdcc1dc13a8e254b531ccf7c9320c46c0f1e0bdbf6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              i_toggle_on_left0.png
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\i_toggle_on_left0.png
              • Size 50KB
              • SHA256 328709999b1a02c50d1fbee62ec282ed39e752c6422fb3e09300ddd49efea191
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redis-cli.zip
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\redis-cli.zip
              • Size 217KB
              • SHA256 188f7a5bd082064bc965d7681a9baebfdd247a419d12c9cf058a9330d28b7fa7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wget.zip
              • Path C:\Users\Admin\AppData\Local\Temp\AtlasUtilFiles\wget.zip
              • Size 1.9MB
              • SHA256 6d539c88438a430289dd7d2c10570294e2bc08169323f6b74bdf0a0be640819b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiscordSendWebhook.zip
              • Path C:\Users\Admin\AppData\Local\Temp\DiscordSendWebhook.zip
              • Size 5.8MB
              • SHA256 eeb59bb74460bd4fc07c0e8fe145ac4e974e5f747b2c4cfa322c09d34b01f76c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MainGUIData.txt
              • Path C:\Users\Admin\AppData\Local\Temp\ExportData\MainGUIData.txt
              • Size 82B
              • SHA256 7f2c2e785662bb633c6022b0cc099585c81f2c38736e1f62dfa7881e2bdf0b1a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MainGUIData.txt
              • Path C:\Users\Admin\AppData\Local\Temp\ExportData\MainGUIData.txt
              • Size 82B
              • SHA256 079b0b948d14afc4c8b5745742473a994b94525a58b1cc0d02b6000054a8aad0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              NetworkConnectionsViewer.zip
              • Path C:\Users\Admin\AppData\Local\Temp\NetworkConnectionsViewer.zip
              • Size 539KB
              • SHA256 a71c4a4f049cb4cadae4b54144b38b87e413af14236b6b32cd11091fdc68917c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              steamcmd.zip
              • Path C:\Users\Admin\AppData\Local\Temp\SteamCMD\steamcmd.zip
              • Size 756KB
              • SHA256 7669b170dee42db8ee2273775ed7dfb2d173bdba1b849f70d2c7b379290bce13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtility.ini
              • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtility.ini
              • Size 19KB
              • SHA256 f62632386d1e3754e972f97d4268f07e1b21e1708aa65b0c2f363fff4e519e36
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtility.ini
              • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtility.ini
              • Size 6KB
              • SHA256 c74e8f0915d34b5155225242ae2a70ddcac15a89c491eba4a8955526142a5d41
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtilityGridStartSelect.ini
              • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtilityGridStartSelect.ini
              • Size 789B
              • SHA256 80472a9b32d6166a4942b4f3b24de223c2087685e4ce56d994e6ecf774e86d39
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtilityGridStartSelect.ini
              • Path C:\Users\Admin\AppData\Local\Temp\_Config\AtlasServerUpdateUtilityGridStartSelect.ini
              • Size 790B
              • SHA256 5e1dfe405bb7f7227224f94035fa69a1e09c9532740654e5c49fadd48710b5af
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AtlasServerUpdateUtility_LogFull_2026-11-02.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_Log\AtlasServerUpdateUtility_LogFull_2026-11-02.txt
              • Size 4KB
              • SHA256 6995544678d768d3a4cec070d88ba0e21d57ef0f2bc3233867ab558586720054
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AtlasServerUpdateUtility_Log_2026-11-02.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_Log\AtlasServerUpdateUtility_Log_2026-11-02.txt
              • Size 4KB
              • SHA256 2a24b6d17a171ac03543f5839cbb3222da2ec72afd08e532c763f317841f442b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _SERVER_SUMMARY_.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_SERVER_SUMMARY_.txt
              • Size 1KB
              • SHA256 23b411bf37d2b406d092f715f7f349f92d4dffd7741fee32093f701a1993de24
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              mcrcon.exe
              • Path C:\Users\Admin\AppData\Local\Temp\mcrcon.exe
              • Size 19KB
              • SHA256 2bbe34b0d6ac2c44ade7ebbf1ee5d749f45c5610d88b456575b78e686a706794
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              mcrcon.zip
              • Path C:\Users\Admin\AppData\Local\Temp\mcrcon.zip
              • Size 9KB
              • SHA256 52248a0b4bda337d1d1304046a2b580d0fe23d13d76b73cbc989bd457c862bc1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1716-904-0x0000000000400000-0x000000000040F000-memory.dmp
              Download

              memory/1716-878-0x0000000000400000-0x000000000040F000-memory.dmp
              Download