c7a1abb5315adbf2dd5203ab2bdcfc325d66660bc4e980e8964131d63dab2208

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
Size 414KB
Sample260809-xh9fnstfpf
SHA256 c7a1abb5315adbf2dd5203ab2bdcfc325d66660bc4e980e8964131d63dab2208
MD5 069bfede0b08a114db7a96a58e204820
SHA1 14e88f3e69a94fbdb3c2ce0131d531209a4e6262
SHA512 305e40fa66e1e93eccb2bf15c8a84290e1c2bbc4c0a2c636165f7d5a8a6deac9259416e5c6ec8fad27c50b1a2bad4443668ff013ee9a8dcb0a14f35fd7c74a26
SSDEEP 12288:OplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:6xRQ+Fucuvm0as
TLSH
T161947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	customer.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\require\customer.exe	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	customer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4648	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
4648	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
4648	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
4648	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
4092	customer.exe
4092	customer.exe
4092	customer.exe
4092	customer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4092	4648	2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_069bfede0b08a114db7a96a58e204820_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files\require\customer.exe
  "C:\Program Files\require\customer.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

customer.exe

Path C:\Program Files\require\customer.exe
Size 414KB
SHA256 cb211b710f5f60cb242a93e7f79ae3ab53bc3c6f0ade06b48a2463cacc962efc
MD5 c364f5fd60b6c56f8377a9a5b27c79a8
SHA1 cc0b799df9fc0bfb419ba93dae2fb4c890dd9635
SHA512 97f858a283353a5a78c5e6680e221d75d201f08213b266024f707a84ff7c58c6c69102e2b5386badd88dc8d65389e39164f7faf815854a4d4b32921f6457548b
SSDEEP 12288:PplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:hxRQ+Fucuvm0as
TLSH
T16D947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4092-6-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/4648-0-0x0000000000400000-0x000000000056E000-memory.dmp