fd7ef7bed35551cafb43ebff01cb987550941e80c976a7efd29d2b0cd21e9a2f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
Size 415KB
Sample260602-ch7xmacx8k
SHA256 fd7ef7bed35551cafb43ebff01cb987550941e80c976a7efd29d2b0cd21e9a2f
MD5 36c6bed3c19128b985f6d7c573872859
SHA1 ff0758226596ce9dc8288c1a1bc107bc7ed9dc42
SHA512 65a50124dd3fec4ac6899678cb8db7622f211868c1401f3bd9ed4aa368b135332936ea8caf659e17d21163fd08cebef1c18b4ca16774324d551d7cdf41b809e4
SSDEEP 12288:WplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:yxRQ+Fucuvm0as
TLSH
T185947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4004	behavioral.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\previous\behavioral.exe	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	behavioral.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4116	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
4116	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
4116	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
4116	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
4004	behavioral.exe
4004	behavioral.exe
4004	behavioral.exe
4004	behavioral.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4004	4116	2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_36c6bed3c19128b985f6d7c573872859_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Program Files\previous\behavioral.exe
  "C:\Program Files\previous\behavioral.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

behavioral.exe

Path C:\Program Files\previous\behavioral.exe
Size 416KB
SHA256 64563dca353d6471c44c684f95ad10d848a3af1d9116635f96be43ccd17a28f7
MD5 414b389cc20d625be0e674d8a000d032
SHA1 e2f935421bc74bad9c2e7db59f872fdf9dd15fb1
SHA512 eedcedc6d5a69a1779c725094a74d43f69f8c96155a41b533b3a4f093d38c3ab50b4af0d5b42d0d37d7cb11feade7fefdfe23598c9417816a3bf5f7b5f13cf51
SSDEEP 12288:LplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:9xRQ+Fucuvm0as
TLSH
T1B0947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4004-5-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x000000000056E000-memory.dmp