25b5ad7a22f072e44a9049059f2efe9631a8ca9b8e93aa7702eb47d4a835d7f2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe
Size 436KB
Sample260802-c9q37asfpc
SHA256 25b5ad7a22f072e44a9049059f2efe9631a8ca9b8e93aa7702eb47d4a835d7f2
MD5 a982e41ab9584365cb3675ed2a625921
SHA1 e2add94eb847771199597913431a62b0ae7baf94
SHA512 7f3d389e6248d59a47b23daf13c743581b28e823aa00fee08f3a5816c025e39918c4dcca641cbe821c4c1ac18df91acd02fa9ee9f0f4d8214bdfa010219debab
SSDEEP 12288:f82uOsfWwQFuaRHqHZw3dwtQJFwxXJiUSLb:rxQaIwtwtqFwxXJpSLb
TLSH
T19C94AD1137D2C076D5A602B24D9AD75876B6BDA0AF361AD3FFD42F8E2E301D18A39314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Schirmer\pcTest.ini	2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3140	2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe
3140	2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a982e41ab9584365cb3675ed2a625921_amadey_elex_emotet_smoke-loader_stop.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pcTest.ini

Path C:\Program Files\Schirmer\pcTest.ini
Size 3B
SHA256 ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad
MD5 900150983cd24fb0d6963f7d28e17f72
SHA1 a9993e364706816aba3e25717850c26c9cd0d89d
SHA512 ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f
MD5 SHA1 SHA512

Submit Download