6922cb3fc621f1ed8bbbb1de0e574bf871dc01e93c672bf48f642385374b3861

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe
Size 59KB
Sample261006-xf997atxes
SHA256 6922cb3fc621f1ed8bbbb1de0e574bf871dc01e93c672bf48f642385374b3861
MD5 9a6c3da0473e7c681e3c6e90c2edc552
SHA1 957cfc537cc67936deee1c342ed48b1d97914265
SHA512 79d7fd696938a961e458704d4807688b439476c868df22df643bc0304b745f1108896224d8f4e9788ca7a9dddd065d82625c2dd4660c52249dbe699df1bb48ce
SSDEEP 1536:EvQoLHjw2iWPKMvw71sMLyXuhcVVVOHHHJ:Ev5Ls27BIJsMLyXuhbHHHJ
TLSH
T1EF435D56AAC198D2D2A7023444A273BB3CB76C39491ED546FF81FA8E08B5D41FA77703
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011370-1.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 1 IoCs

pid	Process
5352	dgihost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\dgihost.exe	2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe
File opened for modification	C:\Windows\Debug\dgihost.exe	2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dgihost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dgihost.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dgihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dgihost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dgihost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1216	2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 5104	1216	2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_9a6c3da0473e7c681e3c6e90c2edc552_elex_nitol_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5104

C:\Windows\Debug\dgihost.exe
C:\Windows\Debug\dgihost.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dgihost.exe

Path C:\Windows\debug\dgihost.exe
Size 59KB
SHA256 8785a893004cc2f8d4ad24f28725213162dd7e4d19ef9ea8ca5b77155977c8a9
MD5 0e656bef363b9f9dc7fe969763e8d85f
SHA1 ee556d72d73fae0ff68fb4449c880858f39df01a
SHA512 04b3dd98aeae55909f68c1f4879682ebe5fc9a0b7a45affcbf0857ed8d9df77b60132db2ef7949f663d0d7e06512dabadd586f22aab5ad45acd8c2ebf6aae4a3
SSDEEP 1536:EvQoLHjw2iWPKMvw71sMLyXuhcVVVOHHHd:Ev5Ls27BIJsMLyXuhbHHHd
TLSH
T1C4435D56AAC198D2D2A7023444A273BB3CB76C39491ED546FF81FA8E08B5D41FA77703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download