xorist | 37a3d5aa175d77aad40275830199e79eb7982350a5ece8f8b9976edb6ace497b

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_0ac64421f38cdcabe7271a96a4484c33_amadey_elex_remcos_smoke-loader_stop_xorist.exe
Size 14.2MB
Sample260807-ejl3nazxav
SHA256 37a3d5aa175d77aad40275830199e79eb7982350a5ece8f8b9976edb6ace497b
MD5 0ac64421f38cdcabe7271a96a4484c33
SHA1 d7292e6c3c75b65e90b24fb672c35469e1938984
SHA512 50b0a23b0ebe84777a853ec604af507ae3ae271c263f709fb48a876196d331fa6c88f4356bc1532c9edc80ecda860e9b3d79f0e7cc76c12102579bb03dd83ade
SSDEEP 393216:uQEwfPNJAI/g1TNDdrSSEjLTA1Qrs1NCevwIFkaEfb7:uQjnNJAIYDdrSSEj/eQrs2DIE
TLSH
T1D7E623861CDE80F4DAC41930861FAFDB27B317B54E804C797EC1298AE962FF66076C56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xorist ransomware

Malware Config

Signatures

Family: Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Detected Xorist Ransomware 1 IoCs

resource	yara_rule
behavioral2/memory/3356-0-0x0000000000400000-0x0000000001246000-memory.dmp	family_xorist

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4400	3356	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_0ac64421f38cdcabe7271a96a4484c33_amadey_elex_remcos_smoke-loader_stop_xorist.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ac64421f38cdcabe7271a96a4484c33_amadey_elex_remcos_smoke-loader_stop_xorist.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0ac64421f38cdcabe7271a96a4484c33_amadey_elex_remcos_smoke-loader_stop_xorist.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3356
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 420
  2⤵
  - Program crash
  PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3356 -ip 3356
1⤵
PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3356-0-0x0000000000400000-0x0000000001246000-memory.dmp

Download