e53da8228100cdcab093325d35f4c9ff67c5a9ca555da6c1b34e2ad6a7d90120

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
Size 208KB
Sample260808-nxd4mswcpg
SHA256 e53da8228100cdcab093325d35f4c9ff67c5a9ca555da6c1b34e2ad6a7d90120
MD5 6c01b32643170130f16b6f05da4250f8
SHA1 463453f5dc2db579c4ce728fc7c9128033ebaa41
SHA512 44a1d37b1d5f83c0070605bf3a017a83118ea76740db95e3d8ebde0f0f8bbb108b07b7b196a042746d766c44b3fc099c85f471d7a8ccf6e3178efab53687a134
SSDEEP 3072:ALQaL9tbLkRIgd1Lye9yjE2hWAN5XbplU6L+LOftw9LthEoBHqj:UlZtbLWIgd1LZ9oECZbplUi+LO1QEog
TLSH
T124248D1235C2CC73E4B7027588F6C7787BB6BC919B3A928B7BC03B4D6E315968A25351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	GGTH.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	PENI.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	FZMZ.exe

Executes dropped EXE 4 IoCs

pid	Process
4832	GGTH.exe
1560	PENI.exe
1712	FZMZ.exe
3888	AURRTX.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\PENI.exe.bat	GGTH.exe
File opened for modification	C:\windows\SysWOW64\AURRTX.exe	FZMZ.exe
File created	C:\windows\SysWOW64\GGTH.exe.bat	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\AURRTX.exe	FZMZ.exe
File created	C:\windows\SysWOW64\AURRTX.exe.bat	FZMZ.exe
File created	C:\windows\SysWOW64\GGTH.exe	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File opened for modification	C:\windows\SysWOW64\GGTH.exe	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
File created	C:\windows\SysWOW64\PENI.exe	GGTH.exe
File opened for modification	C:\windows\SysWOW64\PENI.exe	GGTH.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\windows\FZMZ.exe	PENI.exe
File opened for modification	C:\windows\FZMZ.exe	PENI.exe
File created	C:\windows\FZMZ.exe.bat	PENI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
684	cmd.exe
1360	cmd.exe
4524	cmd.exe
1524	cmd.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3272	4292	WerFault.exe	84
2612	4832	WerFault.exe	89
1972	1560	WerFault.exe	95
2508	1712	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FZMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AURRTX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GGTH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PENI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4292	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4292	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4832	GGTH.exe
4832	GGTH.exe
1560	PENI.exe
1560	PENI.exe
1712	FZMZ.exe
1712	FZMZ.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4292	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4292	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
4832	GGTH.exe
4832	GGTH.exe
1560	PENI.exe
1560	PENI.exe
1712	FZMZ.exe
1712	FZMZ.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 684	4292	2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe	85
PID 684 wrote to memory of 4832	684	cmd.exe	89
PID 4832 wrote to memory of 1360	4832	GGTH.exe	91
PID 1360 wrote to memory of 1560	1360	cmd.exe	95
PID 1560 wrote to memory of 4524	1560	PENI.exe	96
PID 4524 wrote to memory of 1712	4524	cmd.exe	100
PID 1712 wrote to memory of 1524	1712	FZMZ.exe	101
PID 1524 wrote to memory of 3888	1524	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_6c01b32643170130f16b6f05da4250f8_elex_emotet_stop.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\windows\system32\GGTH.exe.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\windows\SysWOW64\GGTH.exe
    C:\windows\system32\GGTH.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\windows\system32\PENI.exe.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\windows\SysWOW64\PENI.exe
        
        C:\windows\system32\PENI.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1560
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\FZMZ.exe.bat" "
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\windows\FZMZ.exe
        
        C:\windows\FZMZ.exe
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\windows\system32\AURRTX.exe.bat" "
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\windows\SysWOW64\AURRTX.exe
        
        C:\windows\system32\AURRTX.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 1328
        8⤵
        Program crash
        
        PID:2508
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 1324
        6⤵
        Program crash
        
        PID:1972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 960
      4⤵
      Program crash
      PID:2612
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 976
  2⤵
  - Program crash
  PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4292 -ip 4292
1⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4832 -ip 4832
1⤵
PID:4732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1560 -ip 1560
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1712 -ip 1712
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FZMZ.exe

Path C:\Windows\FZMZ.exe
Size 208KB
SHA256 62ef6912db399d8af7b868ea4023bbe3b65177d713d537a4db0ae47923df0305
MD5 c517aecefeaeae3920195757cdf11942
SHA1 b7322e483d7985b6a22db6344af625c7e4315b8e
SHA512 8725cc13f89a55a1be1ca523ab79d4bc49b2d344dcbd4333dab9fd45380871845440c00795904131c414b7be789e3c9042061bd69cd946e8d841a08e918d5483
SSDEEP 6144:plZtbLWIgd1LZ9oECZbWMWeSBJFSuXeKClQIXMaWibUNQEog:XLWI09QZb/g2KqMPWUNQk
TLSH
T1BF249DC132D6C173D0B712758CF5A3ADABFAFD11AF76A24BB7403B0E89316064924B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GGTH.exe

Path C:\Windows\SysWOW64\GGTH.exe
Size 208KB
SHA256 1a4531f032bc2e71ccd03247ad8e6add1ca93f41bb5c73cea6f7c1563eb67fb3
MD5 e90faa37a227cbbb538502ac15682860
SHA1 2e84d58439007f5def2c4e529db40a8a0e046ef2
SHA512 d86f581c0e701b46b7acaa4c99f076a5fc86e8269a686c08d36c0cb6b234916a8624935d07b7c11989c1fac80e14398f1516604ad0c13ae8127ad732917c448b
SSDEEP 6144:0bexFZMttt3odPyh3wgrNHP+Yl9K738QEog:4exFZMt7+Yl9K7MQk
TLSH
T1EF247B497252851BF04BF73498F1C7E8BEBABCE04FA6914B3B58333E6D345264905B98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FZMZ.exe

Path C:\windows\FZMZ.exe
Size 208KB
SHA256 198fd8195ed8367abe28429a285616308015d403ea89cd093f73cbaed7c8320c
MD5 c9f0c70dbea0cb64a8b29abecc39b24c
SHA1 5e94b4774e01e103085d485e01e8176b318e4dad
SHA512 4afaa9c599da9ee43c6f84669a2d7f4e2200341e0b76448ef3638ed4d1c98b6b5920f70a57c8e319f5588c9c04a6a27d13cf6dc16b927461d60458aff7f7c321
SSDEEP 6144:4vQajAjYmmBfDLmvQJMWeSBJFSuXeKClQIXMaWibUNQEog:4vQZjYmmBevg2KqMPWUNQk
TLSH
T1C7247CC13169D597D43B47398CE1A39A4FBFFC21AF76A39BB5803B4E44396264850FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FZMZ.exe.bat

Path C:\windows\FZMZ.exe.bat
Size 54B
SHA256 9fdd2089aa5c73154332eeb743bb53b9e390558456694522d4a7349815377826
MD5 084cd93f96f51609a4940bed0ca858b2
SHA1 ec525ea17079a917998377260020557a27efe5ee
SHA512 eb49c99663ebd4e93d082057d634cb7135721be5db38b0e8bff234dc0c5234f1fd20c12d4500c8b71730df43641504612c09e242df214830a55458452e9333d5
MD5 SHA1 SHA512

Submit Download

AURRTX.exe

Path C:\windows\SysWOW64\AURRTX.exe
Size 208KB
SHA256 08c8dcf2ec6582b983a3c81f3e0cad56025738569e5b290db5c1fe1f309568ec
MD5 5efd357077ab38a5518e28574dd74a34
SHA1 3b0f580d4c9a0ef252334beb931e14e053535a27
SHA512 39cbdb3bcd658097d48d73709443e607c366f824f05a758d44040657de7252624a3ee7bf05d11b3506daa41fb42a546b1463b279d306b63b7857f2454ddef602
SSDEEP 3072:0e7iOsyAvZnZonpwRRc3UyJZ2dWi4F3Hh47JrU4MrET2yecHlFvwEfuJf8w9Lthk:XsyAvZrUJZ2w3BmZhBSyeyAAtQEog
TLSH
T148247C0A39D5D107E167227188D981A43A7EBC47BAB5020B75D4B7BD6D722884F83BF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AURRTX.exe.bat

Path C:\windows\SysWOW64\AURRTX.exe.bat
Size 76B
SHA256 13a7e96ac50d529ccd930c30213d4152ebfcb595064650941bbac142754ee77c
MD5 7a3ec8dcb7adeb4868989a021430f2ad
SHA1 993b03ae40526bff27be47afe7766f8638fa610f
SHA512 fd817ab97b3e806c7a7d272f74315fc7718dd99a43209c657538a2d39b9c875f40669134a97b7d240979092b70e44504c406d2d9aa49a8a89f98a9e6179d832f
TLSH
T199A0043007C151F04C15405DC34577314415F4C5035101D0315515C1F0544575D17C74
MD5 SHA1 SHA512 TLSH

Submit Download

GGTH.exe.bat

Path C:\windows\SysWOW64\GGTH.exe.bat
Size 72B
SHA256 f24baca628dc1eb074ca7dc6a7826b53bb55c1be46adeaa16a999854c9398308
MD5 09e0fcb3d7d8ee81bfca453b3d45155a
SHA1 106fc4427210b8b44f2d5f9c7f93611732424431
SHA512 4149720e68c42ec31931ef267b2c96823d389e5d92ad67f541d80373fa1c8007df7c58baee64c5ebaa3990efc7a67f962994053f0f969187825dc2a3fc50e5e7
TLSH
T103A002300BE922E8A82C607FE34A3F30A4AAF44A031000381395A0CAE08447BCA20CBA
MD5 SHA1 SHA512 TLSH

Submit Download

PENI.exe

Path C:\windows\SysWOW64\PENI.exe
Size 208KB
SHA256 fd8415947c83909704a88abe558ef8b7952bc11cafcf1ea6a0b2bf7affb3084d
MD5 19991761dab678c0a07e60efb14f14d9
SHA1 ac40e73d95d9864ab294e24309b85c51bf31dac1
SHA512 8975c3cd71cb487c1028a5efc82ff77dbf1e399e992e18a42548321329ac5f5894f2a4cf211abdda54b66827ba972bfad166b79e5e5afc00d6048edb64fdf336
SSDEEP 3072:IW/2mP4p+Mq71DoihnRxhtJOcWfon9+ESz47rTiRI0pow9LthEoBHqj:IW/94p+Mq711hnXhkfonhS3RInQEog
TLSH
T1E9246C46BAF1F453C877077688FAC6A49E26BC719B3F4107F508735E0C722B98919B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PENI.exe.bat

Path C:\windows\SysWOW64\PENI.exe.bat
Size 72B
SHA256 d75814438fe98e9f8d83364fd07a2a7dfcbb3aa29c4e563fa03c625b38a6532f
MD5 268558f56f989f3424e867604eb295a3
SHA1 8386902d36bd1b3c3d604396f1691a4ab24406a5
SHA512 9f91e9c3061cd5fef1bc303c71e9f10e3d5cfc8a5425ed327a9f57a174d5db3223d5d396bc20df62dec5d4d68029130582e7d6ee20557090ddc4b3af9fd66234
TLSH
T123A002300AC120E88C2460EDCB4A372204AAF44A0B1200201AD520E2E084C4B8EA0CFC
MD5 SHA1 SHA512 TLSH

Submit Download