7858a02efcdba36bdae53a70e90963bc189ce9fd7902c965c20db9f49723a929

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
Size 410KB
Sample260422-fe3qaac12w
SHA256 7858a02efcdba36bdae53a70e90963bc189ce9fd7902c965c20db9f49723a929
MD5 80d1f2e772935e42eff982c4e24af17e
SHA1 1b040c5203e5ab6158f29d13604029db380d3a04
SHA512 1ecfd5f7a198470f13e8ecad2ba23a517bfa9a0817eada1aaf97e47f382874ca7050bdebed90b9755f78c010333adc237f2590488c632e59988d6b7d617d81b7
SSDEEP 12288:gplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:8xRQ+Fucuvm0as
TLSH
T1DC947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5076	match.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\build\match.exe	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	match.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
892	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
892	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
892	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
892	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
5076	match.exe
5076	match.exe
5076	match.exe
5076	match.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 5076	892	2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_80d1f2e772935e42eff982c4e24af17e_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
- C:\Program Files\build\match.exe
  "C:\Program Files\build\match.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

match.exe

Path C:\Program Files\build\match.exe
Size 410KB
SHA256 f5d07f4826c2c933b30c062d66a87aec2e84d2361e62d4a5a77ca0c1c5c5ae2d
MD5 d44cc45b8551300467349f8b52c23bf3
SHA1 d25a2fe1148b63001eb1872c9c53d9d3b0d34a47
SHA512 0254a06980bd9727dd8825c1892c4ef4e57a6647d949ad45f10ef01747d26f9d6d2520231ad509e45adadb14d33c451ae94e225f8d3615ef8d3434e63483498a
SSDEEP 12288:1plrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:nxRQ+Fucuvm0as
TLSH
T163947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/892-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/5076-5-0x0000000000400000-0x000000000056E000-memory.dmp