54e9cdbf4a71255aec1113ed2266acdbe5ff3cbf92e610ff70ad79f3ddffd764

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_98392dd345bbfe66d41369e74d287d0d_elex_emotet_stop.exe
Size 208KB
Sample260811-taaetswcka
SHA256 54e9cdbf4a71255aec1113ed2266acdbe5ff3cbf92e610ff70ad79f3ddffd764
MD5 98392dd345bbfe66d41369e74d287d0d
SHA1 40dcf56028c3fb83ee5952d42421ef44721fbacd
SHA512 32752be123a25dd7459670a319eb045dd876e3ef6d1324bac92e0ca705a049124d3cad3f6ae02627ea42e8a026f009f829d59b88fb62f3b73796232669092593
SSDEEP 6144:MlZtbLWIgd1LZ9oECZbEyJqa6wSc7be8kEj1:OLWI09QZbTqa6wSc7be8kC
TLSH
T1E4248D217AC2C0BAD5F726304CF6D6E867B1FD518F76910B3784371E6E722A14A29F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4584	1036	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_98392dd345bbfe66d41369e74d287d0d_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_98392dd345bbfe66d41369e74d287d0d_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_98392dd345bbfe66d41369e74d287d0d_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 476
  2⤵
  - Program crash
  PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1036 -ip 1036
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1036-1-0x0000000000400000-0x0000000000438000-memory.dmp