e341cbce4930b4a0d6bccaa8200828c54a9b5bb612159c52f492df336e5f36d0

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
Size 414KB
Sample260707-ctl5asfz8t
SHA256 e341cbce4930b4a0d6bccaa8200828c54a9b5bb612159c52f492df336e5f36d0
MD5 8e166db96a00a82c93f2a1b465ce4766
SHA1 0668d7f0f5882af3b2e5e8828362a7e16e8a09d3
SHA512 74b0133edc443e9a1ffc44d1cfd0a34bfcf0f24f6bd7422d4e724206fac82dbea587e696c9c22acb30c31f3feb7bc8b4135b1dc1397604fcf06954b8fddc6234
SSDEEP 12288:vplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:BxRQ+Fucuvm0as
TLSH
T1C5947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1116	Framework.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\verify\Framework.exe	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Framework.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3552	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
3552	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
3552	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
3552	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
1116	Framework.exe
1116	Framework.exe
1116	Framework.exe
1116	Framework.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 1116	3552	2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8e166db96a00a82c93f2a1b465ce4766_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files\verify\Framework.exe
  "C:\Program Files\verify\Framework.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Framework.exe

Path C:\Program Files\verify\Framework.exe
Size 414KB
SHA256 330c51ea37c48f487a4bc6e4a9bc85014855c88b979d70dcab442816cc63c479
MD5 93715e50b130d364e7aa8aaf225c1579
SHA1 1c1409a76ed67fb986f0f067081e534a79ab55a7
SHA512 7b2851993b17446da9daa2ad6a7c26718ccfa79fb1fdbcedffa3ea20f4076d4e13b95f764c4f6f0913c3db3dc32ec093f27cfae2563958e27f98e257f4dc2564
SSDEEP 12288:bplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:NxRQ+Fucuvm0as
TLSH
T122947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-6-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/3552-0-0x0000000000400000-0x000000000056E000-memory.dmp