9d3bba8066cc579265cd29e2573be025c80acd6f50c9b1c4f4afdb579ec885e0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe
Size 4.6MB
Sample260809-ygz2aaxyey
SHA256 9d3bba8066cc579265cd29e2573be025c80acd6f50c9b1c4f4afdb579ec885e0
MD5 7973c6e1e1fbd32a78aaa19d963a1056
SHA1 1bff0dd366304da259dc9d4eb11618d63a34251c
SHA512 795e90fc8c6e9918b7864223f07628131d0c6da4f8e979e5be4c398ea3b7d628f703af50fa517ac700f1d655110a10989cbf8887179e957c966f02b875e293fa
SSDEEP 98304:qvWC15mKLkAXpcdArHjK27dvAk9JLleHVbDc4bi+X+ST:mWC1HzGW7ikjLaVbDji+X+ST
TLSH
T13A2622017BF2C070E775B1B40457C76B26FAA4A58B3047C7A7A42F2A2E751D17F3826A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2964	4696	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4696	2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe
4696	2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7973c6e1e1fbd32a78aaa19d963a1056_elex_remcos_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 720
  2⤵
  - Program crash
  PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 4696 -ip 4696
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads