Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 18:46
General
- Target 2026-08-09_1d6a21e51208587622e410d220bf1982_amadey_elex_emotet_icedid_remcos_smoke-loader_vidar.exe
- Size 14.0MB
- Sample260809-xeszhsteqf
- SHA256 a1353f815c0f7d8c4db482ea15ca1de63d09f6ebb5ec754ad6eb08ba98c7ae69
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_1d6a21e51208587622e410d220bf1982_amadey_elex_emotet_icedid_remcos_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_1d6a21e51208587622e410d220bf1982_amadey_elex_emotet_icedid_remcos_smoke-loader_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1792-0-0x0000000000FC1000-0x0000000000FC2000-memory.dmp
memory/1792-1-0x00000000012C0000-0x00000000012C1000-memory.dmp
memory/1792-2-0x0000000001820000-0x0000000001821000-memory.dmp
memory/1792-18-0x00000000031E0000-0x00000000033E3000-memory.dmp
memory/1792-17-0x00000000031D0000-0x00000000031D1000-memory.dmp
memory/1792-23-0x00000000031E0000-0x00000000033E3000-memory.dmp
memory/1792-16-0x00000000031C0000-0x00000000031C1000-memory.dmp
memory/1792-15-0x00000000031B0000-0x00000000031B1000-memory.dmp
memory/1792-14-0x00000000031A0000-0x00000000031A1000-memory.dmp
memory/1792-13-0x0000000003190000-0x0000000003191000-memory.dmp
memory/1792-12-0x0000000003180000-0x0000000003181000-memory.dmp
memory/1792-11-0x0000000003170000-0x0000000003171000-memory.dmp
memory/1792-10-0x0000000003160000-0x0000000003161000-memory.dmp
memory/1792-9-0x0000000003150000-0x0000000003151000-memory.dmp
memory/1792-8-0x0000000003140000-0x0000000003141000-memory.dmp
memory/1792-7-0x0000000001880000-0x0000000001881000-memory.dmp
memory/1792-6-0x0000000001870000-0x0000000001871000-memory.dmp
memory/1792-5-0x0000000001860000-0x0000000001861000-memory.dmp
memory/1792-4-0x0000000001840000-0x0000000001841000-memory.dmp
memory/1792-3-0x0000000001830000-0x0000000001831000-memory.dmp
memory/1792-24-0x00000000031E0000-0x00000000033E3000-memory.dmp
memory/1792-25-0x0000000000400000-0x0000000001228000-memory.dmp