2dab7f60e4da309b09f1b1ec5e81c3fa0afe1521770a62b248470a09c1c22372

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
Size 415KB
Sample260804-nbl75aydlc
SHA256 2dab7f60e4da309b09f1b1ec5e81c3fa0afe1521770a62b248470a09c1c22372
MD5 7a46bff0811b1b42edb50c6b9bb0539b
SHA1 18ebe845178a049650e1fe49e11d742d1c549157
SHA512 38b4f300700b280106c8fc062681eaff6a01515cecdc305844fc1f83c4a129216ac0f0e2256d174c0a4bbab572481a0d7fbb0c79e3da5f0c73cddea10a753114
SSDEEP 12288:VplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:HxRQ+Fucuvm0as
TLSH
T187947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1480	games.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\and\games.exe	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	games.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2420	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
2420	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
2420	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
2420	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
1480	games.exe
1480	games.exe
1480	games.exe
1480	games.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1480	2420	2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7a46bff0811b1b42edb50c6b9bb0539b_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files\and\games.exe
  "C:\Program Files\and\games.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

games.exe

Path C:\Program Files\and\games.exe
Size 415KB
SHA256 04f2e7d5012da733264a989b8e6c268dea5190c8a668cf03634eeba2a5afcec3
MD5 c50967276e97bcd5ce94a5f2a88a4030
SHA1 f1cb2e53102cd120becf8571007db80d102c7ab6
SHA512 91b9dd89db8e5503731800f3e825781758318a67fce2835f908661806072a4abdfef3d109a4436a433c96ab69dc67ae869846822af7ac765f45401985639a1fb
SSDEEP 12288:qplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:GxRQ+Fucuvm0as
TLSH
T1FE947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-6-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2420-0-0x0000000000400000-0x000000000056E000-memory.dmp