959f10b6924bd6caee9aa9506a554bd1f70d4b257f3ddf41bdb42d0173ca292e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe
Size 124KB
Sample260730-ac1v1sha46
SHA256 959f10b6924bd6caee9aa9506a554bd1f70d4b257f3ddf41bdb42d0173ca292e
MD5 6f01823510244fbbde150e05a96cbc9a
SHA1 0aee0d2da152a9ba025d42f5951cbc8cc829529e
SHA512 7bf3373ce558be3bdb9a96cae13199644593ab99453acb66ee9ccd1533324d36e46247ebeb990a79f4abe89ad31344d284433af063840953a28ff79b7633bc63
SSDEEP 3072:mRh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUja:eh1qn3IF9Obbj/a1cpcQjeHOzqhUj
TLSH
T170C3E767F20B81A3D863027156507B32EEBCBC311A5D5157E7E8D8811DF588E902AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
360	2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_6f01823510244fbbde150e05a96cbc9a_elex_parallax_remcos_remocs_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rmlogs.dat

Path C:\Users\Admin\AppData\Roaming\remcos\rmlogs.dat
Size 74B
SHA256 d9e0aeb8285dd545b1bc1d4353104da10e06f2e00d3a1be696f5f6983a5680d5
MD5 1c6da8af291651206f253bc7d2723250
SHA1 b211a6bffe1b2e09e101dfc842932bd1a05d8478
SHA512 67822aa77ed5b25993bd6008521b7346a4e696f8956ccb0a6e388598a2e225b3046a14248343a6c45f92535f29be6e8ab5106cef1849524e22d550122b89bff7
TLSH
T131A024134F1DC571170F014FFC40C340511040C1504C04C070501C1F4013C31411F44C
MD5 SHA1 SHA512 TLSH

Submit Download