7858a02efcdba36bdae53a70e90963bc189ce9fd7902c965c20db9f49723a929

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
Size 410KB
Sample260422-fe3qaac12w
SHA256 7858a02efcdba36bdae53a70e90963bc189ce9fd7902c965c20db9f49723a929
MD5 80d1f2e772935e42eff982c4e24af17e
SHA1 1b040c5203e5ab6158f29d13604029db380d3a04
SHA512 1ecfd5f7a198470f13e8ecad2ba23a517bfa9a0817eada1aaf97e47f382874ca7050bdebed90b9755f78c010333adc237f2590488c632e59988d6b7d617d81b7
SSDEEP 12288:gplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:8xRQ+Fucuvm0as
TLSH
T1DC947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3160	build.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\headers\build.exe	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	build.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2912	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
2912	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
2912	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
2912	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
3160	build.exe
3160	build.exe
3160	build.exe
3160	build.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3160	2912	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Program Files\headers\build.exe
  "C:\Program Files\headers\build.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build.exe

Path C:\Program Files\headers\build.exe
Size 410KB
SHA256 88fc05fc284e0c87e9abe14f50efe1c3189bf17ed3aa4c74f3fc88acb850a102
MD5 63e7720964683cb9d6bc3068dedc0af9
SHA1 f06fb57d4787ab5acbfaff01f5f559dba9924910
SHA512 07d390312c007b2183cf9ffa957f8e981b1bfaad65a9a71743308f293ec56f83632a0e6fddfd73f3d34ad304cb8aa9d610d113ef2be66877d0a70110eddb7283
SSDEEP 12288:LplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:9xRQ+Fucuvm0as
TLSH
T11C947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2912-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/3160-5-0x0000000000400000-0x000000000056E000-memory.dmp