49c9bc91454d10d5ac5c70f5d9415aeb35c84baa9d3014609b599176c3dd285c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_05b016875b191848bb8ebdc4fbe94bbb_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
Size 81KB
Sample261024-2r1mcaew5n
SHA256 49c9bc91454d10d5ac5c70f5d9415aeb35c84baa9d3014609b599176c3dd285c
MD5 05b016875b191848bb8ebdc4fbe94bbb
SHA1 7ed973c99d5dc0a00e5f5d788f6133e1e2147309
SHA512 21802d87d888a9aab3433cb4e62f198f53c5b87bdbb3c56d1b17373e2dd50861082bf4eb0aaf6027e9905c03dd709ab83423a8e2c1c8c3e0bd0912e70587b84e
SSDEEP 768:damUkTe2uVf8VPZopRwqKDRPRDUVojyH6ojY9Pi7DTLfLPaYNl7trPCjuOKShyEj:da9iexVfeTV+ojyHDmq3TLjPayABvl7
TLSH
T12F83AE93EE4660E3E452007C7869A7FA59FF0C72871EA297DF50DC8128F5315F53A2A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/1264-0-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/1264-1-0x0000000000400000-0x000000000041C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3280	1264	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_05b016875b191848bb8ebdc4fbe94bbb_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_05b016875b191848bb8ebdc4fbe94bbb_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_05b016875b191848bb8ebdc4fbe94bbb_elex_gh0st-rat_nitol_remcos_scribble_virut_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 316
  2⤵
  - Program crash
  PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1264 -ip 1264
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1264-1-0x0000000000400000-0x000000000041C000-memory.dmp