2587651b34ad8a1557e69eda8e67babf91e952cd89f9abd66cb3b68d37fec50f

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop.exe
Size 352KB
Sample261009-tkxm4sca96
SHA256 2587651b34ad8a1557e69eda8e67babf91e952cd89f9abd66cb3b68d37fec50f
MD5 445f85db4b859994658886116e2d837f
SHA1 a84b9c275a19932d010dd395be2555f92107277b
SHA512 5689d5642455c75e8a8188302485c83e466bfe7829b4738a8e7e9a941a1c2383b74028df8bbf92adb46a4f562df70335d73b0893c709353a2047ed4bd99ca7ca
SSDEEP 6144:JbcV2cA6JpS7yX6hmtOgb9wx3CAmAO9/WBV+UdvrEFp7hKx0k:k2cAUpSGX6hmtOG9+3CdXWBjvrEH7rk
TLSH
T1CD74CF15F6D0C3F1C9860931744ADB36CAFA563C0BB546DBE3E01A5D9E2C3F19A3660A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_445f85db4b859994658886116e2d837f_amadey_elex_floxif_remcos_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-0-0x0000000000400000-0x0000000000453000-memory.dmp

Download

memory/2996-1-0x0000000000400000-0x0000000000453000-memory.dmp