583c5ce10c513e5717299783297f66e34f34aa2c57ba3c949b01474a1c5ed0ec

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe
Size 48KB
Sample261017-saffeavzds
SHA256 583c5ce10c513e5717299783297f66e34f34aa2c57ba3c949b01474a1c5ed0ec
MD5 6fef1b6cfb84efc89b85d20e43abfeea
SHA1 e06fa0b3f11e5e36524809820c95dcc44c30eeef
SHA512 71639e8afbfc8c325c0fab07edbe9aad4c985d8a0ab98cfc7ae7a3180eb38d13affec40352cc4098d07cc7828ce052dc05906028e0909fb39b2dddfa463b53ec
SSDEEP 768:7TT8R3ev8GEe854yRVnQbhcdqDMhYgfyHRVZHOYcV:7f8R8+54yRVnQdufyHRjuYu
TLSH
T1E623E60BED8448F1F42A60F7640AA7FB52E32871590FA746AF41DCDD2C75A2BED2520D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000000053e-0.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4600-2-0x0000000000400000-0x0000000000410000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 1 IoCs

pid	Process
2984	umuemy.exe

Loads dropped DLL 1 IoCs

pid	Process
2984	umuemy.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\umuemy.exe	2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe
File created	C:\Windows\SysWOW64\gei33.dll	umuemy.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	umuemy.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	umuemy.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umuemy.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4600	2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_6fef1b6cfb84efc89b85d20e43abfeea_elex_gh0st-rat_remcos_scribble_strictor_wannacry.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
PID:4600

C:\Windows\SysWOW64\umuemy.exe
C:\Windows\SysWOW64\umuemy.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gei33.dll

Path C:\Windows\SysWOW64\gei33.dll
Size 9KB
SHA256 a9988faccd43389849eae44b7a4fef598eab4f87de271e4620c74067fab509ed
MD5 080565b1c8e742960fee4ae48d6ea567
SHA1 20fe4e4f539ac0ed9aa7ed648a868ed14dc859c6
SHA512 8ac6acd2f34b50eed94b93aa8c82147bbad541e4ba3ba4e40020805cb8c700b9501d5044776194da6121eb1bf2955ca4104beba3226aff68253da026060eb759
SSDEEP 192:mRtnXeDk34YAnvkKFQ4rB0y6fTWA/2Uxs:AXeDd6uOy4TN2cs
TLSH
T137122F15A99481F2F52B56FB7483479724E62C315C873812DED36D8A3CB9B5BEE3020E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

umuemy.exe

Path C:\Windows\SysWOW64\umuemy.exe
Size 48KB
SHA256 583c5ce10c513e5717299783297f66e34f34aa2c57ba3c949b01474a1c5ed0ec
MD5 6fef1b6cfb84efc89b85d20e43abfeea
SHA1 e06fa0b3f11e5e36524809820c95dcc44c30eeef
SHA512 71639e8afbfc8c325c0fab07edbe9aad4c985d8a0ab98cfc7ae7a3180eb38d13affec40352cc4098d07cc7828ce052dc05906028e0909fb39b2dddfa463b53ec
SSDEEP 768:7TT8R3ev8GEe854yRVnQbhcdqDMhYgfyHRVZHOYcV:7f8R8+54yRVnQdufyHRjuYu
TLSH
T1E623E60BED8448F1F42A60F7640AA7FB52E32871590FA746AF41DCDD2C75A2BED2520D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-2-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads