c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc

General

Target
2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos
Size 3.6MB
Sample260925-mep8hsdd39
SHA256 c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc
MD5 4d1d450478d98d243a94134d47b4a7e9
SHA1 450672088a0a928f3204487f3ce4dcfbbf44a2d0
SHA512 d99ece892cd621ab19b2a775a2496e81bc54eeacd456036da6684d4923573de1ce26e1d88560e98b81afe3c91d14ecadd4d17f1a953988049c00be9fb694bc48
SSDEEP 49152:zk+SBfV2x+EUE3OU1dN5dDzS3BoLpQR1BONzzS3BoLpQR1BONYn1XR7:z7gd2x+EROU1N1I621MzI621MGf7
TLSH
T16306BE13E252A0E5E21E85744672573EEBF23D251B20A7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_4d1d450478d98d243a94134d47b4a7e9_coinminer_elex_emotet_glassworm_remcos
- Size 3.6MB
- SHA256 c6d8059004c1f648f0029337770dffc04039a6192feb8fe99a3f49a9db9736cc
- MD5 4d1d450478d98d243a94134d47b4a7e9
- SHA1 450672088a0a928f3204487f3ce4dcfbbf44a2d0
- SHA512 d99ece892cd621ab19b2a775a2496e81bc54eeacd456036da6684d4923573de1ce26e1d88560e98b81afe3c91d14ecadd4d17f1a953988049c00be9fb694bc48
- SSDEEP 49152:zk+SBfV2x+EUE3OU1dN5dDzS3BoLpQR1BONzzS3BoLpQR1BONYn1XR7:z7gd2x+EROU1N1I621MzI621MGf7
- TLSH
  T16306BE13E252A0E5E21E85744672573EEBF23D251B20A7DBDFD0FD212E326D1A63B205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

credential_access defense_evasion discovery evasion execution persistence privilege_escalation ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Installs a root certificate to the trusted certificate store
  A root certificate was added to the trusted certificate store using CertUtil.
  defense_evasion
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Modify Registry: Disable Windows Driver Blocklist
  Disable Windows Driver Blocklist via Registry.
  defense_evasion
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2