959f10b6924bd6caee9aa9506a554bd1f70d4b257f3ddf41bdb42d0173ca292e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe
Size 124KB
Sample260730-ac1v1sha46
SHA256 959f10b6924bd6caee9aa9506a554bd1f70d4b257f3ddf41bdb42d0173ca292e
MD5 6f01823510244fbbde150e05a96cbc9a
SHA1 0aee0d2da152a9ba025d42f5951cbc8cc829529e
SHA512 7bf3373ce558be3bdb9a96cae13199644593ab99453acb66ee9ccd1533324d36e46247ebeb990a79f4abe89ad31344d284433af063840953a28ff79b7633bc63
SSDEEP 3072:mRh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUja:eh1qn3IF9Obbj/a1cpcQjeHOzqhUj
TLSH
T170C3E767F20B81A3D863027156507B32EEBCBC311A5D5157E7E8D8811DF588E902AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4504	2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rmlogs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\rmlogs.dat
Size 74B
SHA256 1c0b23cc51e5ff1701aa831da2f1294005263d82cc4256f0988978f83b6643a0
MD5 e378eebe1847fb6a6ca90576b03976d8
SHA1 9a5f62f508bb34edc244317d2588a351807ce9a6
SHA512 35b4d91ebd3dd09d479e30aca837b34a3dfb10224fdddb7e9961ee916288a0fc518701bc4b43fc370191164328be4eb2b3df4ca52e4e8794afcc20c577ed96ba
TLSH
T1EFA024134F0D45511F0F014FFC40C340511040C150CC04C07050141F4013C31411F44C
MD5 SHA1 SHA512 TLSH

Submit Download