6e173ad0c6bb82da2eea14d3ba848c5dbf531b4d0dfde5ee77decd04caa84678

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
Size 390KB
Sample260804-dh4ewafj4x
SHA256 6e173ad0c6bb82da2eea14d3ba848c5dbf531b4d0dfde5ee77decd04caa84678
MD5 3f1f159823dd0a3eff4e1d19c4ea1488
SHA1 0bbc2752140700d9bf08778d68fed13b04b7b6c2
SHA512 0e2e6ac0556abf17d1e70e01c9ac7791adac010ff47b32553c33d9cd7ad63c20dcb5c525232512176750b1baed47a623ae975bc3052f2a0e32067033caacc5dd
SSDEEP 12288:gplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:8xRQ+Fucuvm0as
TLSH
T10E848C02B7A1E170C6C311398F136B7675EAEBA52B62E7C723803A4D9D35AC1653930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4876	having.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\without\having.exe	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	having.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2236	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
2236	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
2236	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
2236	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
4876	having.exe
4876	having.exe
4876	having.exe
4876	having.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4876	2236	2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_3f1f159823dd0a3eff4e1d19c4ea1488_cobalt-strike_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files\without\having.exe
  "C:\Program Files\without\having.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

having.exe

Path C:\Program Files\without\having.exe
Size 390KB
SHA256 dc0ff52cd4495b16b86da4a610e630b00d39c32e8fb9d5aed27bdae0d82c7b4b
MD5 8df44c33c426a1a9adda0880e1d6bfb7
SHA1 8293a71b94e64fea5471a5c76aba7b6256a07633
SHA512 65724e6f87da8c62bd85d293e02cbf0986299b82218bd5136f5def13d069d987a2185a0a5c4c5774359c35746ed380070165a577abda8e56ffb534973858684e
SSDEEP 12288:wplrVbDdQaqdS/ofraFErH8uB2Wm0SXsNr5FU:MxRQ+Fucuvm0as
TLSH
T1AC848C12B7A1E170C6C311398F136B7675EAEBA52B62E7C723803A4D9D35AC1653930F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download