ff31c20e71c09bc6db103ca8942155672a6a7039a55b0b0f150a04fa4af01ee6

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_9f7c716507400f99becb807a8c4b9d25_elex_emotet_stop.exe
Size 208KB
Sample260923-yvmccawdmc
SHA256 ff31c20e71c09bc6db103ca8942155672a6a7039a55b0b0f150a04fa4af01ee6
MD5 9f7c716507400f99becb807a8c4b9d25
SHA1 4330ee3949ee63d79fdf06855d014477af94e348
SHA512 717174a3d346bdf2a701998079154a7841f8aeeb5d8b21f15a69de709dd4600d56d8fb1a6c35add05798948328807fa966a3b4d2e08f0a451f4287dc451ee3d4
SSDEEP 6144:7NlZtbLWIgd1LZ9oECZbBUCgQjsrgBvxW1igQtTssDkEj1:PLWI09QZbB/giwigMsikC
TLSH
T14224AE2279C18833E0B716708DE5C778A7FAFD12DBB6114B77423B0D5D729A08919BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5072	840	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-23_9f7c716507400f99becb807a8c4b9d25_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-23_9f7c716507400f99becb807a8c4b9d25_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_9f7c716507400f99becb807a8c4b9d25_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:840
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 540
  2⤵
  - Program crash
  PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 840 -ip 840
1⤵
PID:4332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/840-1-0x0000000000400000-0x0000000000438000-memory.dmp