ffd6d3ff4a186b2556b316ab408a374b671bb2c8343deb636b6d33e38e7b9d41

Analysis

max time kernel
149s
max time network
95s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
Size 408KB
Sample260416-ehe8qafs2l
SHA256 ffd6d3ff4a186b2556b316ab408a374b671bb2c8343deb636b6d33e38e7b9d41
MD5 53bb1007853e41b45c4b3f1407d5c9b7
SHA1 3d1c8b31ca9f7d84af2ed9d80776376bcd75340d
SHA512 08fe9e802da85dde480b1a123d4c29fd98eb67924922f55cfb67c2d50cdf541d6beec629bdd8d93ce7297cdc25d575e91032993bf150b23307c8291154563c27
SSDEEP 12288:0plrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:wxRQ+Fucuvm0as
TLSH
T12E947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	Brazil.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\ortuguese\Brazil.exe	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Brazil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2548	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
2548	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
2548	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
2548	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
2412	Brazil.exe
2412	Brazil.exe
2412	Brazil.exe
2412	Brazil.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2412	2548	2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_53bb1007853e41b45c4b3f1407d5c9b7_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files\ortuguese\Brazil.exe
  "C:\Program Files\ortuguese\Brazil.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Brazil.exe

Path C:\Program Files\ortuguese\Brazil.exe
Size 409KB
SHA256 956955d53206b287cf2c02a5d8c9c8894707add26881f09c474159038fa1127a
MD5 59fe093d63965412bf5edc5a21a6822e
SHA1 d24c100661f930f8f12ba1cd0864ba3e40ace442
SHA512 beb96ad87d0d6317c60d681c88d89bb404c4dbcdf04c1ac4841c9d91dbf339b2da3b52901200284313981090cae4a0ca829dc13e844a70df419ee476e071ae9c
SSDEEP 12288:cplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:oxRQ+Fucuvm0as
TLSH
T14A947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2412-5-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2548-0-0x0000000000400000-0x000000000056E000-memory.dmp