e4af2bae4133e6bba9d2691977d8a2b69f7dc93edcdc598a9e34ade718101c47

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
Size 415KB
Sample260807-ctfyaaen8v
SHA256 e4af2bae4133e6bba9d2691977d8a2b69f7dc93edcdc598a9e34ade718101c47
MD5 4d51e666cfdf16c4eef1188f6de65ed5
SHA1 70605789bcbb5f178a7da3e5563e23122d021e95
SHA512 8f8ef840f043640c41acf31384474f3e93c6d3c811981b1fe793d0c49af42a2612c2a22486eba90f8250a57d28235494529c7839230ce47b60f051f417c0e2cd
SSDEEP 12288:PplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:hxRQ+Fucuvm0as
TLSH
T120947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4800	interface.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\handling\interface.exe	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	interface.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1188	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
1188	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
1188	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
1188	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
4800	interface.exe
4800	interface.exe
4800	interface.exe
4800	interface.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4800	1188	2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4d51e666cfdf16c4eef1188f6de65ed5_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\handling\interface.exe
  "C:\Program Files\handling\interface.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

interface.exe

Path C:\Program Files\handling\interface.exe
Size 415KB
SHA256 3e7c3865f45b3e1a227b810983579863a5bc654f49c21f78447300eb0631bf54
MD5 7b015cfd1be9f3520244af9da44b7bf7
SHA1 15e26ec4c6517b4b19b9a24738042019356a6202
SHA512 f8b54ec5be0ed3160f7b0a022ca90f2fd43418d96155ae54b201d9e908bda91d4edcaf7b79bca166fbacc3c2f9aa1ea4e7c17da0ca5c025dc0b7dd5cba4cca12
SSDEEP 12288:OplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:6xRQ+Fucuvm0as
TLSH
T106947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1188-0-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4800-6-0x0000000000400000-0x000000000056E000-memory.dmp