5d17de0d113d34e2eb0fbf7d458e9ba38fe7134a13229b82dcae7d8fc4a5e71f

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_29de34a7f3fbca5682be0fd5eb3c88c0_elex_emotet_stop.exe
Size 208KB
Sample260816-sdd2radl4x
SHA256 5d17de0d113d34e2eb0fbf7d458e9ba38fe7134a13229b82dcae7d8fc4a5e71f
MD5 29de34a7f3fbca5682be0fd5eb3c88c0
SHA1 b8d8158750dba2ac7dedc25756eb8fa6a4702345
SHA512 f2cb6ac416ecc2ab3c61edb2253078fc8cc505195bdd335221817a6077c7714af279c3e4dab6e0f81f46672775df747ae5a4cfb9716b023f769b95266fa407bb
SSDEEP 6144:MlZtbLWIgd1LZ9oECZbtA9dLgyNtluSLV8g5kEj1:OLWI09QZbyuXSRpkC
TLSH
T1F0249E1236D2C036E1BB013189EE57A877B9BE119FB2D21FA740770E6E75E88C925371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5984	4824	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_29de34a7f3fbca5682be0fd5eb3c88c0_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_29de34a7f3fbca5682be0fd5eb3c88c0_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_29de34a7f3fbca5682be0fd5eb3c88c0_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 540
  2⤵
  - Program crash
  PID:5984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4824 -ip 4824
1⤵
PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4824-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/4824-1-0x0000000000400000-0x0000000000438000-memory.dmp