2cd6ed0630ff8e150dd3dec0e1b6a6d2ff8b5d3a1bc2f614c67d7f7d0a228b88

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Size 3.2MB
Sample260523-sd8lcsbt5l
SHA256 2cd6ed0630ff8e150dd3dec0e1b6a6d2ff8b5d3a1bc2f614c67d7f7d0a228b88
MD5 16c376504c07d3c145adbb36bd0f02bb
SHA1 38c49e7ce43025b6aa3313f1d1e1dfc251af3ecd
SHA512 ddc35a0ec837c0fdd19a1e36c9da50a4ce283c452b466c948d18f5d838056ba48bdada9cfed53ebf27cdf2fc018c6e105923d67d659ced26b99570c7d2decae7
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1N9:DBIKRAGRe5K2UZB
TLSH
T14FF56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	e5852bf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	848	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5852bf.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3936	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
3936	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
848	e5852bf.exe
848	e5852bf.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 848	3936	2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_16c376504c07d3c145adbb36bd0f02bb_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5852bf.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5852bf.exe 240669375
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 1596
    3⤵
    - Program crash
    PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 848 -ip 848
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5852bf.exe

Path C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e5852bf.exe
Size 3.2MB
SHA256 fd0c0f36c4ada66784c5a7fb11b367f44d6860b35ea6ef105b7a52fd1c21df0e
MD5 9c8bb7128907c860e9086a7116cd3c1a
SHA1 e0c3ae82afec8c970b69cb32176cd54514524bbd
SHA512 9c335bed2ad9d657a8cfc2cb0d33ca720230c627000fde89179c8a0ed4592509bba005ba63a7c1dcbb9235dae1d9ecfef0d251a950ea6db626ba915bf32d7642
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Np:DBIKRAGRe5K2UZl
TLSH
T142F56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-7-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/848-9-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/848-13-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/3936-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/3936-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/3936-8-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads