Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 21:51
Behavioral task
behavioral1
Sample
2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe
- Size 1.7MB
- Sample260523-1qqv3set4x
- SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
- MD5 a3a40634b6c0c538bcf6bcf732a07c9e
- SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
- SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
- SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
- TLSH T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 3 IoCs
resource yara_rule behavioral1/memory/3856-0-0x0000000000400000-0x0000000000419000-memory.dmp family_soulclose behavioral1/files/0x000d000000024368-10.dat family_soulclose behavioral1/files/0x0003000000022b20-15.dat family_soulclose - Executes dropped EXE 1 IoCs
pid Process 4292 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe CCTV.exe File opened for modification C:\Program Files\Windows Mail\wab.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe CCTV.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe CCTV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe CCTV.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\CCTV.exe 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe File opened for modification C:\Windows\CCTV.exe 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3856 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 4292 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3856 wrote to memory of 2112 3856 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 90 PID 3856 wrote to memory of 4292 3856 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stopkill.bat2⤵
- System Location Discovery: System Language Discovery
PID:2112
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.2MB
- SHA256 50456c4a46d04bc32693ac34908097e92da392daf6548fd0170352c8521d782c
- MD5 87239288f648719e00a0d15713bd8ba4
- SHA1 d65ca58c36dec70f1280e8c24041d0ce2d527dda
- SHA512 2f3eb0695734a7ec04da1f4b1f50850028c86182e44c243785721b38f1397af4c8e4e54c9a79e1a32e486a3fffb0823a91b1ffee7b64ef6ebb8d15ab99d5e519
- SSDEEP 49152:xowSN2Za/4MnYYJ2ZhqSGLHkJEMCPji0Aj:xoww2ZXIDQIjo
- TLSH T1BDB57C15F2B08233D1B2917189A766A5FA367C114B30C6CF038E7A6D6EF26D19D3532E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stopkill.bat
- Size 284B
- SHA256 2bc24401ea2190d7feb5293be4d8bd615f271ad1c2ee52eb1badf6b541f743eb
- MD5 69576fe98664f860fdd80b82b87dfbad
- SHA1 2269fb75a424ecaf6555eb8e27cdb24db9178782
- SHA512 b8e6e59a9b1e09f5d359623db0457daa716075b30c620b89d1a0233bc59155d511d3d380b0418cd0fc2a814796c415d50c3a4c596c00762ed187676f25569e62
- TLSH T1F8D02B5E46BBCD2F0400D54E06A72C4DC1407D572BC73F217350E11C60E10D9F5D2546
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 1.7MB
- SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
- MD5 a3a40634b6c0c538bcf6bcf732a07c9e
- SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
- SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
- SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
- TLSH T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
- MD5 SHA1 SHA512 SSDEEP TLSH