Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260618-en
2 signatures
150 seconds
General
- Target 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe
- Size 732KB
- Sample260629-gnc2naes8s
- SHA256 3257d10c706e893935f059eb0a0fade95579a43481db2946f9661af94401a200
- MD5 78342960e5f42d5b185b6c8693a06bf0
- SHA1 b85486e60af37c3436327745e5b718d2c57779ce
- SHA512 df4c9b123c29ac350e2a4dfda23a1ae72b8a18fea04f3dd459c248581c71f331d775a724da0e0afe11f8779d213814e3d74c155a279a8a67df781192e50c0ac0
- SSDEEP 6144:jg2MFitDyzNeAXwcUMCllcMLk7wGbSrnbuAfubNeiIfHthEqx+Fqx2Q/f3TaiRBj:WFVXxCbcMLGDubbuAcNe5yWTaij
- TLSH T10EF4F9122285C5FBE5664B3384E0C53963902D5879FD818A27F07F2FAAB19419B3CFD9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe 1216 2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_78342960e5f42d5b185b6c8693a06bf0_amadey_elex_emotet_remcos_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1216