1c84cb9f7d73ebcada161c0f2e9ce0e70d686a4de4b1a32e2ff821a31aaf7471

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop.exe
Size 898KB
Sample260728-vncmsaad84
SHA256 1c84cb9f7d73ebcada161c0f2e9ce0e70d686a4de4b1a32e2ff821a31aaf7471
MD5 87a017a0cfdfa32c4f0125b91042ca1d
SHA1 9daf2f30d43b31f97bddb8c4ed0bb46edc853bc9
SHA512 1d849a196259043b2240dff9ebe0bcc2fbe107e0de9f171a21d80071a1ef76e815a9d560dcb2d59df3fd13c0159377a3be49d0775532f40fd04d6e2f52a36a94
SSDEEP 12288:Q2qFMS6o4LC0zblEOGSEzUvzblE4wEQRUSEcfv44IdmIKy:rBSN4LC0+OP+ac34
TLSH
T1F215BF10F7DAC171E9AB27B018301D281A3ABE853B74C6CF978D7A19CA723D29C75716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_87a017a0cfdfa32c4f0125b91042ca1d_elex_remcos_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IntelGFX.log

Path C:\Intel\Logs\IntelGFX.log
Size 978B
SHA256 c1f62018dbb10fd18e49fbc8bf77035274158640c5c757e1a512b95f87fe8a58
MD5 4e64db32109a252e2d2f19bfc5475c47
SHA1 1da63f1a341fb3fb30ff7dc57e0e312dc33cb090
SHA512 a3eb99f86bd5804ec583220c119f6dec64f18a65699f7ab5405f62453c1361d924b4e088cc662ffcb2868aed768eaeaa77da09c03f1031ce8dfa3496c964a3f0
TLSH
T10611400667EA0108B4B2AB49EAF74072AB273DAA4D78D20D10EC614E1FF354295617FB
MD5 SHA1 SHA512 TLSH

Submit Download

IntelGFX.log

Path C:\Intel\Logs\IntelGFX.log
Size 636B
SHA256 fa55a99e38aba7c738600d93517a3df966f6ba3667195f4b2f959a97dd3d8e76
MD5 6446927fc3052403bb48315dda14b72b
SHA1 becb7fa737c15092468ea534745f826a930127ef
SHA512 5e49c2a85d656453153b82aea5e39ff5bfa0155fbb54b1edf0e390daa664ac2a73fc79df1a1cc2ac7d977c684adaafcd7e7c19237efb19ba90acbc6b370e5e73
TLSH
T19EF0300667EA0214B5B2AB49FAF340729B773D9A4D78920D10DC524A1FF750191617FB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3600-0-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

memory/3600-1-0x0000000000443000-0x0000000000444000-memory.dmp

Download

memory/3600-23-0x0000000000400000-0x00000000004F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads