0a97944b9e7d1c31c9973116ea9ce220cf0693ffce07eaa0154143d0ba0665a8

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe
Size 1.4MB
Sample260731-dml2dsvvey
SHA256 0a97944b9e7d1c31c9973116ea9ce220cf0693ffce07eaa0154143d0ba0665a8
MD5 573e611f1611f04bdb5c7b958e746178
SHA1 dbc02c45abc6cd8b74e4988bfe2062299aad4a61
SHA512 6f648f9ffaa226610295923b85e1c395ac6ff03a0daf96869f09f90177b809b076e20c97d9e17dec3d24345c7d2e163053066234da09602cfac0bb45c3fe0b72
SSDEEP 24576:WW50MFHGuAhbTV93j/diT/fpXBK3m+o+miAVJ35qJoDQ2:33An93j/srJBqmx+Efp
TLSH
T17465B001B68E40B3C701593114BF6B3ADA748E460715DFE797A4EE696C32281EF3727A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
6004	EXE_temp0.exe
4116	EXE_temp1.exe
4580	umuemy.exe
688	umuemy.exe

Creates a Windows Service
persistence

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\umuemy.exe	EXE_temp1.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXE_temp0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXE_temp1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umuemy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umuemy.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
6004	EXE_temp0.exe
6004	EXE_temp0.exe
4116	EXE_temp1.exe
4580	umuemy.exe
688	umuemy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 6004	5900	2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe	89
PID 5900 wrote to memory of 4116	5900	2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe	90
PID 4580 wrote to memory of 688	4580	umuemy.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_573e611f1611f04bdb5c7b958e746178_elex_emotet_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\EXE_temp0.exe
  "C:\Users\Admin\AppData\Local\Temp\EXE_temp0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6004
- C:\Users\Admin\AppData\Local\Temp\EXE_temp1.exe
  "C:\Users\Admin\AppData\Local\Temp\EXE_temp1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4116

C:\Windows\umuemy.exe
C:\Windows\umuemy.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\umuemy.exe
  C:\Windows\umuemy.exe Win7
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EXE_temp0.exe

Path C:\Users\Admin\AppData\Local\Temp\EXE_temp0.exe
Size 932KB
SHA256 a201e86532ef1c2d58aa0cd1b59681a4dab8bb66bc6fd0195bb522c7c95cae1e
MD5 12b85fda4190f0c4cb44633f188b4d23
SHA1 f5fc904c78d11b450e00584a6e0efde0ff3accb2
SHA512 ffd06a8117561529cd007aaf6392c0c81475ec5af884eca28979031a0afe9d0812a42bcb9cdc73d5b7f861d0dfbeb32a49f275a6773877271732870597e27c08
SSDEEP 24576:450MFHGuAhbTV93j/diT/fpXBK3m+o+m6:43An93j/srJBqmx+d
TLSH
T12F158E01B68680F3C705593114BF6736EA74DE460B25CBE793A4EE696C332C1EE3725A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EXE_temp1.exe

Path C:\Users\Admin\AppData\Local\Temp\EXE_temp1.exe
Size 440KB
SHA256 18efffd2659c45dec906cf17fd7c609d30fa9dcf8f40592534537688856a2fad
MD5 5408dbe0892225ebc2ed1092e915886c
SHA1 b2d5e8209271f8e7d599a5da0b7a32611b5afcbe
SHA512 95416583b60bbd2aa4e40ed82e19ce92844e9741406b139c18f30cf0030e739b8ad2ddcd822ae6136a8f5eee0899cb70cb8da3a20812fe00da6e564d762955f4
SSDEEP 6144:DfuXrXUwTo3swC3VbMzdWgD4qJ3rKNcRyIErIO5vGgcItk2hGV:DGbVusl36WrqJLEp+gta20
TLSH
T1F6A4F1096B7E2617CB614D32557E1DFF836C88D00190FE63ADEA79AA843666107C327F
MD5 SHA1 SHA512 SSDEEP TLSH