Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 10:11
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe
- Size 1.2MB
- Sample260701-l8a51sdw71
- SHA256 c1f778e7509392c65a863e7914a651604682461a4cc88f21b03955efec5febf1
- MD5 347e8563d2b74cbfeb65d47fa7f22530
- SHA1 6f7a8f6194b470d065f5069d5cdce8c2ace17d88
- SHA512 9dcaff87b063a69ac8ec9e2b1bcac2f6b8944d894a63c3498759b33b9918a5f349570e085330d7b3fbbd77cab83edd73d6f4a1915193cc22b2c76aa2e1cae7ac
- SSDEEP 24576:rfZanlLXYSKEDRWTg+YeP/YkOqLK9b16MGYhHpr:rPSKRM+Y2ZPLOom5
- TLSH T1C445BF12E193C0F7E604137159BA273AEE749E864A25CE93D390ED796D327E19E2330D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/916-0-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-1-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-21-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-19-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-47-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-46-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-45-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-42-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-38-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-36-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-34-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-32-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-30-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-28-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-25-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-17-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-13-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-11-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-9-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-7-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-5-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-40-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-3-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-2-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-15-0x0000000002470000-0x00000000024AE000-memory.dmp UPX behavioral2/memory/916-48-0x0000000002470000-0x00000000024AE000-memory.dmp UPX -
resource yara_rule behavioral2/memory/916-0-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-1-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-21-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-19-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-47-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-46-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-45-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-42-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-38-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-36-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-34-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-32-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-30-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-28-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-25-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-17-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-13-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-11-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-9-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-7-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-5-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-40-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-3-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-2-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-15-0x0000000002470000-0x00000000024AE000-memory.dmp upx behavioral2/memory/916-48-0x0000000002470000-0x00000000024AE000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe 916 2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_347e8563d2b74cbfeb65d47fa7f22530_coinminer_elex_emotet_remcos_xiaoba.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:916