4b6c4d726109c958d5bebd34b19f7a7997b36e154665fd53f5814d5387919071

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe
Size 1.8MB
Sample260910-e3vh5szwev
SHA256 4b6c4d726109c958d5bebd34b19f7a7997b36e154665fd53f5814d5387919071
MD5 84700c844b3efedd192484bb65a6951e
SHA1 52fc5f9ba5fa16b58535d7147c383406a7e6b8b9
SHA512 b1be3a1a450b2c938ea9111861979c4579764d1ef21102eb2a5f71f19601dd6d3b03dc90d786e9ad03861d8900533cfa75ca093e3a64f94449090cc875190d38
SSDEEP 49152:9ZUhqirKz8p49T81QkzsKSnyb5OZAYhPje:0N0tY1Q4yHje
TLSH
T13B95BF22B7C1C1BAC5830931442EA77AE770E755473499CB77D42A2E9EF0FD29E39290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1464	2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe
1464	2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_84700c844b3efedd192484bb65a6951e_elex_remcos_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-0-0x0000000000400000-0x00000000005DC000-memory.dmp

Download

memory/1464-1-0x0000000000546000-0x0000000000547000-memory.dmp

Download

memory/1464-3-0x0000000000400000-0x00000000005DC000-memory.dmp

Download