7f10d9a54b2bc355a527b94e21aea2cd3c77a175e4947e2757de613aef44c3a8

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
Size 989KB
Sample260529-pepcbsbt4x
SHA256 7f10d9a54b2bc355a527b94e21aea2cd3c77a175e4947e2757de613aef44c3a8
MD5 e04588068cae484c2b5a1420d8bc54c2
SHA1 65a3d5e900915be9c787631e1f87317cf34d0ee3
SHA512 951e6207a4f9183aa90b340863c614d42533c525e4a0e6f1ac9925a16a2040ead1ce7f800552e131318d1e6d32bfcd0ff94b1544de29220731600fd0b25c1425
SSDEEP 24576:sx4Mi4+EaWyZDAbKh6tBoJU0DuF4jovaVGMwxJE/qlpzwuj:QcEaWjrjiA4jova8Mb/qlpzwuj
TLSH
T139257C1236F6FC37E67202B1D439D375B571BE6049318A0B26D02B3D1E78942BD2EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1708	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
1708	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
1708	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
1708	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
1708	2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.data

Path C:\Users\Admin\AppData\Roaming\GetRightToGo\2026-05-29_e04588068cae484c2b5a1420d8bc54c2_elex_emotet_icedid_stop.data
Size 972B
SHA256 30647a8da7eccb7529de0015ba699ec8e503cfbce69bab92a12f45274ec91c71
MD5 d270e7d3db23eec3c038af3176176718
SHA1 57a37ac64c53ad9d8d8a600bc314c90088d72532
SHA512 2817759ada47ca9e11bd9b54dbca001e94957812f6ee2a699d6dc5ea80e2b7cd7f48b2e826817a1b525b39d814160e9613cdfc8c86ee40a3b72938f024156cba
TLSH
T1F211E1DB9139809DD52227D65CF1774061A173C248484D2075F477CC5CA91D6E46E3FE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1708-0-0x0000000000400000-0x00000000004FA000-memory.dmp

Download