2cd6ed0630ff8e150dd3dec0e1b6a6d2ff8b5d3a1bc2f614c67d7f7d0a228b88

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Size 3.2MB
Sample260523-sd8lcsbt5l
SHA256 2cd6ed0630ff8e150dd3dec0e1b6a6d2ff8b5d3a1bc2f614c67d7f7d0a228b88
MD5 16c376504c07d3c145adbb36bd0f02bb
SHA1 38c49e7ce43025b6aa3313f1d1e1dfc251af3ecd
SHA512 ddc35a0ec837c0fdd19a1e36c9da50a4ce283c452b466c948d18f5d838056ba48bdada9cfed53ebf27cdf2fc018c6e105923d67d659ced26b99570c7d2decae7
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N9:DBIKRAGRe5K2UZB
TLSH
T14FF56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	e5822f4.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	2836	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5822f4.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1996	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
1996	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
2836	e5822f4.exe
2836	e5822f4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2836	1996	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5822f4.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5822f4.exe 240657281
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2148
    3⤵
    - Program crash
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2836 -ip 2836
1⤵
PID:2232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5822f4.exe

Path C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5822f4.exe
Size 3.2MB
SHA256 962c6b236a4a05881b0108b17d80af1e6d56b451087e9e47b9796cf7e24c699e
MD5 b34c519ade227b1a3f0c1a3686af6d2d
SHA1 5405a6a7ed262470a5c273581e181ae235289090
SHA512 222ab98621283bd786d51a865eea658831d1ccf1d04ff165aa9592e336417093558c9c95bab3f8adbd6637b7a0c9beec6994a56669850133c0b75d42a2695d29
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N6:DBIKRAGRe5K2UZ+
TLSH
T1CEF56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/1996-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/1996-8-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2836-7-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2836-9-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2836-25-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads