1006f0a8ba82fab11393fdca1215029bb6cef9b509064b5b10819abf4a8447cb

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
Size 271KB
Sample260802-dcxedacb78
SHA256 1006f0a8ba82fab11393fdca1215029bb6cef9b509064b5b10819abf4a8447cb
MD5 8ff011161ceaf5e4aab94c18355ab260
SHA1 0a977ca1e6a6a55ea209df9a10f6dd1855f7530a
SHA512 04b912d7b79a451e8a82c6ef0bf9eaaf5ec99d2006b63dbb9091569c5a661206edfdd04d2801043200c107f0c879dff60d77215729e9169278502fcde037c378
SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T1C0446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1600	Synthesis.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Multimedia\Synthesis.exe	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\Multimedia\Synthesis.exe	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synthesis.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2256	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
2256	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
2256	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
2256	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
1600	Synthesis.exe
1600	Synthesis.exe
1600	Synthesis.exe
1600	Synthesis.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1600	2256	2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8ff011161ceaf5e4aab94c18355ab260_elex_emotet_icedid_rhadamanthys.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files\Multimedia\Synthesis.exe
  "C:\Program Files\Multimedia\Synthesis.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synthesis.exe

Path C:\Program Files\Multimedia\Synthesis.exe
Size 271KB
SHA256 e6e03221e17da2dbc8a96fb086bac492f54c8bd31737b98c9aabf5115b0dd889
MD5 26e133aa5624b51b4146bfc2f24a2581
SHA1 affd6e6e1d355cd2d60bf5b868780cd65bec92a4
SHA512 f44a1f23669a093df5ecaf56698342734a5475b07bcba6cd9b17bb7fe66e5d9d7c4b6bd229cf2f318818783380345c66f915f839310fed36d7134cb5a5ca03f8
SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T175446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download