Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe
- Size 2.1MB
- Sample260731-3vmekaaf35
- SHA256 21bb010e0c40f424be19676cdb2d53f30fcd8925a793f9020c4e52d8aa3865bf
- MD5 5e7a3f48ebf63a6bd7cf3c193701cb3b
- SHA1 658a95b6fc96c78d07fb4680cd18d744fdae370e
- SHA512 27f1c4e43efe71938d7d564df25a85d97f7166f41554ea7bed6c613a94458490ba9b911238b4a95a17396742ab982f7227a731c8db657515556897e8099da2b7
- SSDEEP 49152:2HhkqgYa3/zb1vjaHAk8McldEyjhPEulOj:2G0aPNmHM/tdw
- TLSH T1F0A5BF9136A1C437DAA202F05B218BEC56F0BEE4DA36414BA3D2176D6E725C35B39733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 4812 msiexec.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe - Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4656 msiexec.exe Token: SeCreateTokenPrivilege 4812 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4812 msiexec.exe Token: SeLockMemoryPrivilege 4812 msiexec.exe Token: SeIncreaseQuotaPrivilege 4812 msiexec.exe Token: SeMachineAccountPrivilege 4812 msiexec.exe Token: SeTcbPrivilege 4812 msiexec.exe Token: SeSecurityPrivilege 4812 msiexec.exe Token: SeTakeOwnershipPrivilege 4812 msiexec.exe Token: SeLoadDriverPrivilege 4812 msiexec.exe Token: SeSystemProfilePrivilege 4812 msiexec.exe Token: SeSystemtimePrivilege 4812 msiexec.exe Token: SeProfSingleProcessPrivilege 4812 msiexec.exe Token: SeIncBasePriorityPrivilege 4812 msiexec.exe Token: SeCreatePagefilePrivilege 4812 msiexec.exe Token: SeCreatePermanentPrivilege 4812 msiexec.exe Token: SeBackupPrivilege 4812 msiexec.exe Token: SeRestorePrivilege 4812 msiexec.exe Token: SeShutdownPrivilege 4812 msiexec.exe Token: SeDebugPrivilege 4812 msiexec.exe Token: SeAuditPrivilege 4812 msiexec.exe Token: SeSystemEnvironmentPrivilege 4812 msiexec.exe Token: SeChangeNotifyPrivilege 4812 msiexec.exe Token: SeRemoteShutdownPrivilege 4812 msiexec.exe Token: SeUndockPrivilege 4812 msiexec.exe Token: SeSyncAgentPrivilege 4812 msiexec.exe Token: SeEnableDelegationPrivilege 4812 msiexec.exe Token: SeManageVolumePrivilege 4812 msiexec.exe Token: SeImpersonatePrivilege 4812 msiexec.exe Token: SeCreateGlobalPrivilege 4812 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4812 msiexec.exe 4812 msiexec.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1788 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe 1788 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe 1788 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1788 wrote to memory of 4812 1788 2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_5e7a3f48ebf63a6bd7cf3c193701cb3b_elex_emotet_hijackloader_icedid_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\msiexec.exemsiexec /i "C:\Users\Admin\AppData\Local\Temp\{E32FCAAE-585F-47F1-A2F4-8BF3C49BC502}\VOTANOAPISetup_2.40_x64.msi" /l*v "C:\Users\Admin\AppData\Local\Temp\OMICRON_VOTANOAPISetup_Setup.log"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4812
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\{E32FCAAE-585F-47F1-A2F4-8BF3C49BC502}\VOTANOAPISetup_2.40_x64.msi
- Size 1.3MB
- SHA256 834ba74bd302c86d3b8f77e7bc7db199ec6a7b9ee36f7eeadfb0cc214683e76e
- MD5 fa5ff9b8ca0a7db08bc2349af174534f
- SHA1 3d4a001f0972879ae31dbc13ce287a484cbf9915
- SHA512 ffd666964ed41d330546f5b3dee57eec28cebe332e0e88ad043b998c2212f524a76b3773850abb17b224b3bebfaa8bfb08a33538377aee5e761d6f2a9b1990b2
- SSDEEP 24576:8UdDrQt6+jCRjy5Yo7gDlxELVIsjZNhio:jrQt6ByKdHESAnhi
- TLSH T12755D01CB0414C31D36D3A7212F67AE5DA2D7DBF47760331026E7708EEBDA906A968E1
- MD5 SHA1 SHA512 SSDEEP TLSH