Analysis
- max time kernel
150s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 11:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe
Resource
win11ltsc2024-20260710-en
5 signatures
150 seconds
General
- Target 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe
- Size 270KB
- Sample260712-m9fbssav4y
- SHA256 6e5dff9ebe429e0e1f5981c99d674cf426c54653e947a546778cacf4f9bbdf7f
- MD5 e6cc073fa6d8e0abba9ccfdc74fe9842
- SHA1 d4ce8ac363ec82ed70639e33c4e25440007f1aa3
- SHA512 c38fb2d0cb95fee09b3c3d065ebabfa2a59c3d91d0d55363dbf5603855fcd02dbf8469b3558cee9e3ae95ed7e9160464544204944c75ea6c634a9499011d0620
- SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
- TLSH T1C0446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2032 Spanish.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Russian\Spanish.exe 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe File opened for modification C:\Program Files\Russian\Spanish.exe 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Spanish.exe - Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3568 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe 3568 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe 3568 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe 3568 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe 2032 Spanish.exe 2032 Spanish.exe 2032 Spanish.exe 2032 Spanish.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3568 wrote to memory of 2032 3568 2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_e6cc073fa6d8e0abba9ccfdc74fe9842_elex_emotet_icedid_rhadamanthys.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Program Files\Russian\Spanish.exe"C:\Program Files\Russian\Spanish.exe" "33201"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2032
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Russian\Spanish.exe
- Size 271KB
- SHA256 9206a36e26763c1c892ef84fa3a4c8dca46db26e294fc860988283e3723765bf
- MD5 87603bee6060dafbe1b3d41004749a6c
- SHA1 17f11f47d246191aa9f5c3cd0314784d61ef7b86
- SHA512 249a1a0df204ecfab9a5ff0c8e624f3e9f7f36257c435c5b16423231b583963a4daad6d8cc3d662910f91205e17a9e257d78d694c79c3112e19f08a765ca68b6
- SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
- TLSH T1C0446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
- MD5 SHA1 SHA512 SSDEEP TLSH