Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 10:32
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe
- Size 17.2MB
- Sample260813-mk4yvsxejc
- SHA256 258d9472a8a15a9122e0cee4b3274c900ede5077a6dd16af43ff64bcc4f387c2
- MD5 147bb56d07b4b5701e9c01643fcd5eee
- SHA1 659c15c46fb23b708de8945587969e12cfe10fa4
- SHA512 f6b053edb579a55ee9963b91261bdf12b61e489bf91ed646a599c4ae23984203c6e91952b24a4ca79bb2e94e59f8c9307e57cd9d588008f65779b6fb47334ee8
- SSDEEP 393216:Mxjn14xZ3aZilp5MJqubtvaBqb6XtLBFHklfizb2PcP1O3or3:sjn14DaZilav+q2N9UqXttO3oz
- TLSH T177072302B781C0B2C12716710976AB395BB9DE110F35CB97FB98FE9ACC322D16B66147
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/3336-1-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-2-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-3-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-4-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-5-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-6-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-7-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-8-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-9-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-10-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-11-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-12-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-13-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-14-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-15-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-16-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-17-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-18-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-19-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-20-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-21-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-22-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-23-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-24-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-25-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-26-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-27-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-28-0x0000000000400000-0x000000000155D000-memory.dmp UPX behavioral2/memory/3336-29-0x0000000000400000-0x000000000155D000-memory.dmp UPX - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3336 2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe 3336 2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_147bb56d07b4b5701e9c01643fcd5eee_elex_emotet_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3336