Overview

overview

10

Static

static

3

2026-07-31...os.exe

windows10-2004-x64

10

2026-07-31...os.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-31_c096e8864b7dd01277c8c0fa6c10e2f3_elex_manuscrypt_medusalocker_remcos
  • Size 698KB
  • Sample260731-vc55ysck3t
  • SHA256 bf3450bdd6e86e7c9b63a4ad1a6526e0c0b5d5be5abc7947f16f54a9e3e05781
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryminerpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      2026-07-31_c096e8864b7dd01277c8c0fa6c10e2f3_elex_manuscrypt_medusalocker_remcos
    • Size 698KB
    • SHA256 bf3450bdd6e86e7c9b63a4ad1a6526e0c0b5d5be5abc7947f16f54a9e3e05781
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryminerpersistenceprivilege_escalation

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Cryptocurrency Miner

      Makes network request to known mining pool URL.

      miner

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks