421eeb6b1d19a871ec2dbaa25ba6af8f0f411a587581ffd2195b1102b5aeab27

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_a4cbaf2a953df28710a2ba8058c5f862_elex_emotet_stop.exe
Size 384KB
Sample260603-2wt1csfs81
SHA256 421eeb6b1d19a871ec2dbaa25ba6af8f0f411a587581ffd2195b1102b5aeab27
MD5 a4cbaf2a953df28710a2ba8058c5f862
SHA1 6f1392f92af5eda1cef4b8e9c399a39b20b2f5fa
SHA512 99458dbc75a67893e320ceab81b25e14c9f7776fe6f1679121a8c069b8d5721c63db97651174cd3891c39c73f528bc5049cd26303b0f08ed20bc08170ac0b561
SSDEEP 6144:TlZtbLWIgd1LZ9oECZbkqo67xUDk6QN71mCIkEjiPISUOgW9X+hOGzC/NM:RLWI09QZbS6SDk6K71mCIkmZzcukG2/
TLSH
T194849D167BC68332D2A3033258EF95D0733ABC62ABF586473719B21D2672B7416773A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2648	1544	WerFault.exe	80
1608	1544	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_a4cbaf2a953df28710a2ba8058c5f862_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-03_a4cbaf2a953df28710a2ba8058c5f862_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_a4cbaf2a953df28710a2ba8058c5f862_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 496
  2⤵
  - Program crash
  PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 500
  2⤵
  - Program crash
  PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 1544
1⤵
PID:3508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1544 -ip 1544
1⤵
PID:436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/1544-1-0x0000000000400000-0x0000000000439000-memory.dmp