fa1a11908b4ef9181bd5a7bdd1baf9cf806e2a804b7c4589a5ee7676ec97fcaa

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_6f660d6f2977cf784effb3baee30626b_elex_emotet_stop.exe
Size 208KB
Sample260730-v3yhsstckd
SHA256 fa1a11908b4ef9181bd5a7bdd1baf9cf806e2a804b7c4589a5ee7676ec97fcaa
MD5 6f660d6f2977cf784effb3baee30626b
SHA1 97c19896381d733d161e86a3d37820f7720dd625
SHA512 9193151af580f9d408c19e39a9c2500e3519a63aa26433de0b470235ba0c44fa43e2189bc1b2fd6e570e64beeb74ca9b803e0e19047e29d400a9027ec59b0414
SSDEEP 6144:olZtbLWIgd1LZ9oECZbDb01tETSqo6n/AQn0TkEj1:SLWI09QZbn01tgj/AQckC
TLSH
T1E5248D2136D2C073F1B70631CDE546A8F776FDA09BA3420B7B853B1E2A715998E1D3A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5620	3880	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_6f660d6f2977cf784effb3baee30626b_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_6f660d6f2977cf784effb3baee30626b_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6f660d6f2977cf784effb3baee30626b_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 548
  2⤵
  - Program crash
  PID:5620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3880 -ip 3880
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3880-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/3880-1-0x0000000000400000-0x0000000000438000-memory.dmp