e88d57038f66c0504d95c62747149ec680ea6a929b6add741c47b3f26b4f6992

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Size 3.2MB
Sample261002-pv673sseqa
SHA256 e88d57038f66c0504d95c62747149ec680ea6a929b6add741c47b3f26b4f6992
MD5 6cdaa2318353118f883c34c7e301e300
SHA1 26c89d53a2f9d6b336a6b5c500ec7d36284d3a1b
SHA512 8cd07fca070812e15a778a39022f1a68888c23260a6306ee827a4cae0a1bbe886c297e0248fac8f4e2849a438a4d2fc6bd06bbe1f3aefb7d5e995c813d44ebca
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nn:DBIKRAGRe5K2UZ7
TLSH
T129F56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2980	e591c87.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	2980	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	e591c87.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	e591c87.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e591c87.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2680	2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
2680	2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
2980	e591c87.exe
2980	e591c87.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2980	2680	2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6cdaa2318353118f883c34c7e301e300_elex_emotet_glassworm_hacktools_remcos_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e591c87.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e591c87.exe 240721046
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 2152
    3⤵
    - Program crash
    PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2980 -ip 2980
1⤵
PID:5680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e591c87.exe

Path C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e591c87.exe
Size 3.2MB
SHA256 324d525dbe1664f9da0b1d81734f40abd5092925def9466df4880e2575ccf8b9
MD5 03282e8f95230589caa7a2a28a6ad19e
SHA1 ef9c789b88225ee101c7d0ae5e399496654ac000
SHA512 e009231bd051e43cf3b2e56b9bd1faab4347d99bae5543ceff769e41a4638d0720e4cb935f4625de4f32b4fce614fdd93ebce46a034c2bafa2c352b7d6a22252
SSDEEP 49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Np:DBIKRAGRe5K2UZV
TLSH
T13CF56C23E24240B1E2391A702272123DB6356B704D7AD997EFD0DDF05E7A7629BD720E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2680-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2680-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2680-17-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

memory/2980-21-0x0000000000400000-0x00000000007A5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads