Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 21:51
Behavioral task
behavioral1
Sample
2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe
- Size 1.7MB
- Sample260523-1qqv3set4x
- SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
- MD5 a3a40634b6c0c538bcf6bcf732a07c9e
- SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
- SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
- SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
- TLSH T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Soulclose 3 IoCs
resource yara_rule behavioral2/memory/2248-0-0x0000000000400000-0x0000000000419000-memory.dmp family_soulclose behavioral2/files/0x001c00000002b370-10.dat family_soulclose behavioral2/files/0x000200000002a3f1-15.dat family_soulclose - Executes dropped EXE 1 IoCs
pid Process 3104 CCTV.exe - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf CCTV.exe File created C:\autorun.inf CCTV.exe File opened for modification F:\autorun.inf CCTV.exe File created F:\autorun.inf CCTV.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe CCTV.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe CCTV.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe CCTV.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe CCTV.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe CCTV.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe CCTV.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe CCTV.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe CCTV.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe CCTV.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe CCTV.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe CCTV.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe CCTV.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\CCTV.exe 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe File opened for modification C:\Windows\CCTV.exe CCTV.exe File created C:\Windows\CCTV.exe 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCTV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2248 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 3104 CCTV.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2248 wrote to memory of 4672 2248 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 80 PID 2248 wrote to memory of 3104 2248 2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stop.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stopkill.bat2⤵
- System Location Discovery: System Language Discovery
PID:4672
-
-
C:\Windows\CCTV.exeC:\Windows\CCTV.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3104
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 2.2MB
- SHA256 50456c4a46d04bc32693ac34908097e92da392daf6548fd0170352c8521d782c
- MD5 87239288f648719e00a0d15713bd8ba4
- SHA1 d65ca58c36dec70f1280e8c24041d0ce2d527dda
- SHA512 2f3eb0695734a7ec04da1f4b1f50850028c86182e44c243785721b38f1397af4c8e4e54c9a79e1a32e486a3fffb0823a91b1ffee7b64ef6ebb8d15ab99d5e519
- SSDEEP 49152:xowSN2Za/4MnYYJ2ZhqSGLHkJEMCPji0Aj:xoww2ZXIDQIjo
- TLSH T1BDB57C15F2B08233D1B2917189A766A5FA367C114B30C6CF038E7A6D6EF26D19D3532E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-23_a3a40634b6c0c538bcf6bcf732a07c9e_amadey_elex_emotet_smoke-loader_stopkill.bat
- Size 284B
- SHA256 2bc24401ea2190d7feb5293be4d8bd615f271ad1c2ee52eb1badf6b541f743eb
- MD5 69576fe98664f860fdd80b82b87dfbad
- SHA1 2269fb75a424ecaf6555eb8e27cdb24db9178782
- SHA512 b8e6e59a9b1e09f5d359623db0457daa716075b30c620b89d1a0233bc59155d511d3d380b0418cd0fc2a814796c415d50c3a4c596c00762ed187676f25569e62
- TLSH T1F8D02B5E46BBCD2F0400D54E06A72C4DC1407D572BC73F217350E11C60E10D9F5D2546
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\CCTV.exe
- Size 1.7MB
- SHA256 35f45f01031f86eec654f5879efd01005e494d16c934f5135876e8d2b2fe9507
- MD5 a3a40634b6c0c538bcf6bcf732a07c9e
- SHA1 50df523d74f97489ec47ad3cd878e00898cebdb2
- SHA512 6ea9b49199461bb299871f93939827dab47dcef67993e41d95d4ed2e41b71543a95184579ef22aa15171767d1b88c0d9f48f362865fea8eaa4a3a29c4f3733b6
- SSDEEP 24576:sGPibzfkBlSNziKwA5xfPi1dJU43I98U7nYYJ2tHhADSANLHgZpJEMLu:xowSN2Za/4MnYYJ2ZhqSGLHkJEMy
- TLSH T1DA858C15F2F08437D6B6163159BB66E0F66ABC218B20C3CF138E3A6D6DF16815D2436E
- MD5 SHA1 SHA512 SSDEEP TLSH