Overview

overview

10

Static

static

10

2026-06-26...os.exe

windows10-2004-x64

9

2026-06-26...os.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 10:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_f7c28b1b4b9f62fe38a10d16bb0302c3_coinminer_elex_emotet_icedid_remcos.exe
  • Size 2.6MB
  • Sample260629-m3bp2adv2q
  • SHA256 4da9540f0ef960d869720d8280412c4a9d4bcd75e39f7be60bf9611febded24c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_f7c28b1b4b9f62fe38a10d16bb0302c3_coinminer_elex_emotet_icedid_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_f7c28b1b4b9f62fe38a10d16bb0302c3_coinminer_elex_emotet_icedid_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
      "C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe" 2026-06-26_f7c28b1b4b9f62fe38a10d16bb0302c3_coinminer_elex_emotet_icedid_remcos.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5028
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\LOG\QuellGTA_log_2026-6-29-11-59-15.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QuellGTA_log_2026-6-29-11-59-15.txt
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\Log\QuellGTA_log_2026-6-29-11-59-15.txt
        • Size 248B
        • SHA256 8fb4d726338c93c99f300bbc12665c3528c0269787c75422274468aa14199cc4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 23B
        • SHA256 384d14fd1383538d1340f22d9231241f5ccab6e52d42046787ca630533b438d8
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 175B
        • SHA256 00a288588635d6994385102ba10d273b49078a4ac0bc12deb957934916d93780
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 46B
        • SHA256 c6102c285110753b9be7ad063a4c3da1ea5d50f7109c31d9886170d9139dbe61
        • MD5 SHA1 SHA512
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 175B
        • SHA256 b4f6406fc74ed8e386a173822d8d8b8b25c794eda2a8d6ebbd6bae6b1359fe4a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        QuellGTA.ini
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\QuellGTA.ini
        • Size 175B
        • SHA256 bfc3bfe41bc0e5917d5bd25a6426ff5ed9a94d384d2c16b74ed0b6bcdd7636b2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        UEPcon.exe
        • Path C:\Users\Admin\AppData\Roaming\MageAngela\QuellGTA\UEPcon.exe
        • Size 18KB
        • SHA256 e19f7ce38c4f4dd0f22d5a437b5c6e1e36245dafdc4d88fd96e5e188e1f9fcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5028-6-0x00007FF7DE570000-0x00007FF7DE583000-memory.dmp
        Download

        memory/5028-82-0x00007FF7DE570000-0x00007FF7DE583000-memory.dmp
        Download

        memory/5036-0-0x0000000000400000-0x00000000006D0000-memory.dmp
        Download