fcd01f765dcb9ca6d5e3feaae82960c7a53b06bde406fde5f0c90b3981ad8e40

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
Size 413KB
Sample260909-dkdx1aaf99
SHA256 fcd01f765dcb9ca6d5e3feaae82960c7a53b06bde406fde5f0c90b3981ad8e40
MD5 40aa3120001f2bacce4d7f563561d883
SHA1 e84f6354c8c2edead4a7a12a73e51eadbaba83dc
SHA512 d06f146140ae63d8621d5e93e3e0919e1bc28b9f17f31c3aeba70c5fcb187f49442996b0f1c4bfc8bea1ef3678cffb7e7a46758f708c0c468fc820c48635efca
SSDEEP 12288:splrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:4xRQ+Fucuvm0as
TLSH
T15A947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2268	points.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\lpszRootPath\points.exe	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	points.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2976	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
2976	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
2976	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
2976	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
2268	points.exe
2268	points.exe
2268	points.exe
2268	points.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2268	2976	2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_40aa3120001f2bacce4d7f563561d883_elex_emotet_icedid.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files\lpszRootPath\points.exe
  "C:\Program Files\lpszRootPath\points.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

points.exe

Path C:\Program Files\lpszRootPath\points.exe
Size 413KB
SHA256 ffbbb5651a54f8ec07607764b332a5cb6f67fcb6886bd0e78d1048e255c56551
MD5 639807ddf93272fa48d367f467611e89
SHA1 bb7af650e5f6ee5518f19e5a6007fe08e32f5fe5
SHA512 1e708f630e432f678415e4f6c2457a1d12649ce6444a57418198e5311c11a9306174f0da8f2a2627d5d927ce2cda4f1c95a3cfa132be5dfbb316567a580feb33
SSDEEP 12288:BplrVbDdQaqdS/ofraFErH8uB2Wm0SXsPr5FU:TxRQ+Fucuvm0as
TLSH
T1F4947C12B7B0E170D6C311398F13AB7675EAEFA52B61E7C723803A4D9935AC1653930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-6-0x0000000000400000-0x000000000056E000-memory.dmp

Download

memory/2976-0-0x0000000000400000-0x000000000056E000-memory.dmp