387ac986009b5281b603be07aa8af05fd54fd44b7d181038404b5117bfa61985

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
Size 263KB
Sample260810-2c2absvwfv
SHA256 387ac986009b5281b603be07aa8af05fd54fd44b7d181038404b5117bfa61985
MD5 629384f50c69cd7ed633cf823a867703
SHA1 dc5bd49bc44f3b2e9c0f98584e833bb4aad2df70
SHA512 22dbefd3a7d6771f7f382fa8d4e0d578a3b2a031aef88e092ca892a4c9293072ab90950e78f9379a18023f740190d0188815747a39d77b09234481464dc439ab
SSDEEP 3072:+D1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:i1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T136446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	existing.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\components\existing.exe	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\components\existing.exe	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	existing.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1620	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
1620	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
1620	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
1620	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
4812	existing.exe
4812	existing.exe
4812	existing.exe
4812	existing.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4812	1620	2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_629384f50c69cd7ed633cf823a867703_elex_emotet_icedid_rhadamanthys.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\components\existing.exe
  "C:\Program Files\components\existing.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

existing.exe

Path C:\Program Files\components\existing.exe
Size 263KB
SHA256 4f040efa9f95d3e3fd24c1849171075202ea3761cfc8f6cf8c690ae6f647eeb2
MD5 ec4becc9c2c99b7698ee7ee23c71dcff
SHA1 1d2cd778525284d627ad9937bde5a281a2c4bc75
SHA512 a84b456bab82705b639e4b536aa836edb5102c64354df2ea52ccceac38b85f377691110fef8efd875cc8b3e478a196fef396fd8dc3bba70e4d88b43ebcc3929c
SSDEEP 3072:+D1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:i1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T16A446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download