Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
09/05/2026, 09:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe
Resource
win10v2004-20260130-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe
Resource
win11-20260130-en
3 signatures
150 seconds
General
- Target 2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe
- Size 1.0MB
- Sample260509-lrn1jset2s
- SHA256 ed4e6c4aa65d9d840422a632274f0151265a9b6e1f0c4d954651609beff2c892
- MD5 262b2065f52490174f293cbbeb552247
- SHA1 3f7f1e722a5c3b6667833fdd8d327dd6dcdf8a94
- SHA512 049927df80146f83754ded2dc024543b1c5ef59d37a11f2bc9ed415016fba245e22c2abe8e830f84e08637430952c5189c3e46b2a28e403d691b07a1eb0a35f5
- SSDEEP 24576:5nndbmV9QToaqMsQGuL51azTt9fyIXhKjuj7loLRWlpF:nbmGy2Uzx9fyIXAjUhplpF
- TLSH T1BA258C1236F2FC3BD57106B1D53AC335B5A1BC7088704A0B66D12B3D5A78942BD3AF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2808 2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe 2808 2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\GetRightToGo\2026-05-09_262b2065f52490174f293cbbeb552247_elex_emotet_icedid_stop.data
- Size 664B
- SHA256 1657de64d01ddecce2961dcf4210ad952ed34ee6a4f68890cd892e25dad69944
- MD5 c424a4b5ba3d24ca9376e40857a4c539
- SHA1 f099b561cd16cfad249ad807c96007caa97e43be
- SHA512 b86c8653906ab22f6bfe54cfb58663d273eb8b15ae0e6dacbb13eff8f19923bf4bf047c8ea988069bcb53e544fd1ee1bbc2fc4fbdd32283fe66b725b45a4978d
- TLSH T16601994A413DE0019130E448B1F19BA221A2629A09808EC2E560BC6DFDA700AF2D95FF
- MD5 SHA1 SHA512 TLSH