8e20ebb833f2c21500c0d798d10306555811e67e0f31f7f0b12654a4c886733a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_dbeeb9ca86d55d1a28bc561fc35405eb_elex_emotet_stop.exe
Size 282KB
Sample260807-vmc7xshp2x
SHA256 8e20ebb833f2c21500c0d798d10306555811e67e0f31f7f0b12654a4c886733a
MD5 dbeeb9ca86d55d1a28bc561fc35405eb
SHA1 d9c1715284efe1470dc284e0bf5f3016d9de8871
SHA512 5b80c35072706d89abc4915014a9007d76f0512426b83fe48865ac2f68d380bcfdc5931870dd900b460c977f7a7f49c10619c96900180f9b280133e0e123f413
SSDEEP 6144:TlZtbLWIgd1LZ9oECZbxlUSylyyxl0eBPh2kEjiPISUOgW9X+hOGzC/:RLWI09QZbulyyxl0eBPUkmZzcukG2/
TLSH
T14A548D1776C28373D1A3037109DA86E9BB3ABC715776C6872794720D2B73E68873A391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1888	4176	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_dbeeb9ca86d55d1a28bc561fc35405eb_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_dbeeb9ca86d55d1a28bc561fc35405eb_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_dbeeb9ca86d55d1a28bc561fc35405eb_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 548
  2⤵
  - Program crash
  PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4176 -ip 4176
1⤵
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4176-0-0x0000000000400000-0x0000000000439000-memory.dmp

Download

memory/4176-1-0x0000000000400000-0x0000000000439000-memory.dmp