d5e21ca809200c90c645e91410b7e43484d0e79e448e0924f52f6b908785fa22 | Triage™

Login
Reports

Overview

overview

7

Static

static

3

2026-09-29...op.exe

windows10-2004-x64

7

2026-09-29...op.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_b86a7796c138a52d52453780577310e3_elex_emotet_icedid_krbanker_remcos_stop
Size 1.5MB
Sample260929-wfja2azeqe
SHA256 d5e21ca809200c90c645e91410b7e43484d0e79e448e0924f52f6b908785fa22
MD5 b86a7796c138a52d52453780577310e3
SHA1 969d6ee5b481870d276a565dc84aa87dea1e9f0e
SHA512 7168baf86ef08eb12c04aa72a0a86b658f528db6aaf625917ab7e025d433ad2e552e42407cb1051b1aee69ea0a80d9659c0965486badf83c2a66aa5286765aa2
SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdg:01/kjtPlERDGnlRANRdg
TLSH
T181757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution spyware trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2026-09-29_b86a7796c138a52d52453780577310e3_elex_emotet_icedid_krbanker_remcos_stop.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

21 signatures

150 seconds

adware defense_evasion discovery execution spyware trojan

Behavioral task

behavioral2

Sample

2026-09-29_b86a7796c138a52d52453780577310e3_elex_emotet_icedid_krbanker_remcos_stop.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

19 signatures

150 seconds

adware defense_evasion discovery execution spyware trojan

Malware Config

Targets

- Target
  2026-09-29_b86a7796c138a52d52453780577310e3_elex_emotet_icedid_krbanker_remcos_stop
- Size 1.5MB
- SHA256 d5e21ca809200c90c645e91410b7e43484d0e79e448e0924f52f6b908785fa22
- MD5 b86a7796c138a52d52453780577310e3
- SHA1 969d6ee5b481870d276a565dc84aa87dea1e9f0e
- SHA512 7168baf86ef08eb12c04aa72a0a86b658f528db6aaf625917ab7e025d433ad2e552e42407cb1051b1aee69ea0a80d9659c0965486badf83c2a66aa5286765aa2
- SSDEEP 24576:0++ZwJfwCI8Ddfs/kMUftLGZ98FlE6wI+gfnlRIfaE3JRdg:01/kjtPlERDGnlRANRdg
- TLSH
  T181757C23E691C0F1D11100B11AF5573DAA78BB774E359BA3EB92DEB45D212E2CE1720E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware defense_evasion discovery execution spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwaredefense_evasiondiscoveryexecutionspywaretrojan

behavioral2

adwaredefense_evasiondiscoveryexecutionspywaretrojan

© 2018-2026

Terms | Privacy