6516f792604c06b34daa8f13254a37d416545bad812a6ffb6142add14f10489f

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_e68da7805df9283878d31dab2c06b240_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
Size 66KB
Sample260801-xpkqwsfd49
SHA256 6516f792604c06b34daa8f13254a37d416545bad812a6ffb6142add14f10489f
MD5 e68da7805df9283878d31dab2c06b240
SHA1 c8a6ba43c2d3c486d0bad14cde0f59f65e591f06
SHA512 d91f521198e519ec350a911df2e539d028c5c259aaa51691988f36980fb7a57df1fc8a304d01a40d3138f3c5c5d90adea3612be02ca720225cd3533feebd2f92
SSDEEP 1536:HtxwjjK7lp27GjV3P1Yil3oyzjT/KOpuZi2A1bb6bH6:NqjmJl4yzjT/RZxZWbH6
TLSH
T1F1637D47FFA5A4F2D0110478387E9BB96EA7DC74471A67C7AF40CEA95C70A10ED292C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x0000000000415000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4928-1-0x0000000000400000-0x0000000000415000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	4928	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_e68da7805df9283878d31dab2c06b240_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_e68da7805df9283878d31dab2c06b240_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e68da7805df9283878d31dab2c06b240_elex_gh0st-rat_remcos_scribble_strictor_virut_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 432
  2⤵
  - Program crash
  PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4928 -ip 4928
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4928-1-0x0000000000400000-0x0000000000415000-memory.dmp