c7c9dd078b14b2a2ccdaef5a8d8073c36852e522328cd6ab4ff0875b5efe7a58

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
Size 390KB
Sample260702-vtp53afx5l
SHA256 c7c9dd078b14b2a2ccdaef5a8d8073c36852e522328cd6ab4ff0875b5efe7a58
MD5 7d18ca7793d4d8701e30e85d8f1d93d1
SHA1 3aefaccda8bcfbbc1c84157a1e96e592ab91f306
SHA512 a83d37f5282d3b645e55ede2f97251e34544ae65445d249a70531d0d81a8244dadf32f5bd323601ed9e8f2854a15c458aebfd38e7f9b23eac0ae2cc2ca6c66b5
SSDEEP 12288:dplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:/xRQ+Fucuvm0as
TLSH
T115848C02B7A1E170C6C311398F136B7675EAEBA52B62E7C723803A4D9D35AC1653930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4700	directory.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\root\directory.exe	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directory.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5044	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
5044	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
5044	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
5044	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
4700	directory.exe
4700	directory.exe
4700	directory.exe
4700	directory.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4700	5044	2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_7d18ca7793d4d8701e30e85d8f1d93d1_cobalt-strike_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files\root\directory.exe
  "C:\Program Files\root\directory.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

directory.exe

Path C:\Program Files\root\directory.exe
Size 391KB
SHA256 4d97fb6309882e5ad566841d0a6bcc05363527442d15901b46aa1be6b765d198
MD5 c00eb39d48c69a37e15c7d285e8ba6de
SHA1 059073b48864e6dd2f8ccf1e0983b6a5dd71543f
SHA512 696ac0c60effd83c2a7f020a7b3b4a7b2ef1956521ca630476648a8c7f7a6f88754d20c6abdc5c192dce68f52d5c9636b497f0740fcdd6b3818c9d443faefeed
SSDEEP 12288:qplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:GxRQ+Fucuvm0as
TLSH
T1DE848C02B7A1E170C6C311398F136B7675EAEBA52B62E7C723803A4D9D35AC1653930F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download