ecb01e9f7437af788b2adf35d2f83fd5140b7e1c2623a92682b342e3deb7b563

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe
Size 4.9MB
Sample261016-3zc2paszay
SHA256 ecb01e9f7437af788b2adf35d2f83fd5140b7e1c2623a92682b342e3deb7b563
MD5 07a86dcf83b4c9c47182ab0f0830f3b5
SHA1 6473d2896e63830b46315a471e1228f909c55d3a
SHA512 8fe261d0b4efef485d7299e1697e6bb691de74bd1021ea1c1b2da83c2115d6b5ceb99037b5e765dd6dee26c0882addee4505f4389dc597d61f6086d5b8e09d8c
SSDEEP 98304:DIqCIVk6Pp4z+c3CU5x7lG40/6pCJjsQEMCpC7b1skZClX9C:RVkuuu6pmYQEMYcO+C
TLSH
T12536BE01E65294B6D467057015AF6B7ABE35AF511B018BC3B3CCED281F72781BA3722E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4840	2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe
4840	2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4840	2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe
4840	2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_07a86dcf83b4c9c47182ab0f0830f3b5_coinminer_elex_emotet_glassworm_remcos_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads