1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f

General

Target
2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos
Size 3.6MB
Sample260925-lhytdsysfw
SHA256 1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f
MD5 5667c2bd639baa46e724d7e100a86f7d
SHA1 64cc71041da2c1e3713fb5a2b7b9b937326bd83a
SHA512 727d026ba2593bde247d4f35ae9dd8f2ef9938728ae69b31ffa85dcb93ef7ad9c38a26d7e4b73c59033f70705ecb20624f7ced6c484a11ea463708d5e689457a
SSDEEP 49152:1G1ASBfV2x+EUxWtU1dN5nvMFo/oERcUIXMFo/oERcUIj11XR7:0agd2x+ELtU1NvIscVIscff7
TLSH
T1E106AD12E252A0F5E21E95704262573EEBF27E151B20E7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_5667c2bd639baa46e724d7e100a86f7d_coinminer_elex_emotet_glassworm_remcos
- Size 3.6MB
- SHA256 1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f
- MD5 5667c2bd639baa46e724d7e100a86f7d
- SHA1 64cc71041da2c1e3713fb5a2b7b9b937326bd83a
- SHA512 727d026ba2593bde247d4f35ae9dd8f2ef9938728ae69b31ffa85dcb93ef7ad9c38a26d7e4b73c59033f70705ecb20624f7ced6c484a11ea463708d5e689457a
- SSDEEP 49152:1G1ASBfV2x+EUxWtU1dN5nvMFo/oERcUIXMFo/oERcUIj11XR7:0agd2x+ELtU1NvIscVIscff7
- TLSH
  T1E106AD12E252A0F5E21E95704262573EEBF27E151B20E7DBDFD0FD212E326D1A63B205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2