a0894cdc2dfeedac45132aab4791bac9c498dd770ea4ee25090f80ac882e7cf6

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_abdee10650afdce8ca9fbf25d455d0b3_elex_emotet_icedid_nymaim_remcos_wannacry.exe
Size 6.1MB
Sample260814-d3stwatfld
SHA256 a0894cdc2dfeedac45132aab4791bac9c498dd770ea4ee25090f80ac882e7cf6
MD5 abdee10650afdce8ca9fbf25d455d0b3
SHA1 a0d4477bfa427fb2d6f0b7c371d5b96582ccebeb
SHA512 e7032716e21ca81473be6a001cd53e31a36bc4500eceeb6964a3e52bfb29639484c3cd636a288b4ff4dc7dc91aacae7ff958cff4de112d7db1e90b8bedf5fca8
SSDEEP 49152:+pSpdC3zS1TVs1P0g9B3AD9zWE6+lDJqLY4dP3TRhPE4vvBh5HivOu:atzOB2sS309zbfhJqJdPDRdvph5HivO
TLSH
T1CE562911B3E95465F2F72E766EF56335893BBD965A22C69F12A0F80E0832A50CD31337
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5804	2196	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_abdee10650afdce8ca9fbf25d455d0b3_elex_emotet_icedid_nymaim_remcos_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_abdee10650afdce8ca9fbf25d455d0b3_elex_emotet_icedid_nymaim_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_abdee10650afdce8ca9fbf25d455d0b3_elex_emotet_icedid_nymaim_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 552
  2⤵
  - Program crash
  PID:5804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2196 -ip 2196
1⤵
PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2196-0-0x0000000000611000-0x0000000000612000-memory.dmp

Download