60a3a28e1c6b7a3872739c2d402cff4f2472f6da2b5124431401efa09d69c52e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_9b3686cc06e48b89a56ac4194657e1d7_elex_emotet_icedid_remcos.exe
Size 924KB
Sample260721-xpqbdaec93
SHA256 60a3a28e1c6b7a3872739c2d402cff4f2472f6da2b5124431401efa09d69c52e
MD5 9b3686cc06e48b89a56ac4194657e1d7
SHA1 9082f19cda42be14f8741190583fedff3a57fe5c
SHA512 bbde8b5e79018a2c80ddb8694eb676532a031884eab0bb444341d24d2d655831698a8f898a76a40f5d130365cd49de7e689412084d02850156e87915b67fed35
SSDEEP 12288:DYfmShFFETrx6mQGdvmZHi08nO86k9gh+RvBtQm4JnEhgt6zcwrf:sfmIFqTrx5QGAs06V6Ib18nEhxzr
TLSH
T18615BF11B6B1C4B2D68951304D2BCB78E9626D42CB218AE762E47F1E2DF33C05E36F59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4448	4832	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_9b3686cc06e48b89a56ac4194657e1d7_elex_emotet_icedid_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-21_9b3686cc06e48b89a56ac4194657e1d7_elex_emotet_icedid_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_9b3686cc06e48b89a56ac4194657e1d7_elex_emotet_icedid_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 580
  2⤵
  - Program crash
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4832 -ip 4832
1⤵
PID:6632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-0-0x0000000000400000-0x00000000004EC000-memory.dmp

Download

memory/4832-1-0x0000000000400000-0x00000000004EC000-memory.dmp