60fe92ea2de301ee0a4d7d0b365f08547ccf92c726621980775af3fac66c1819

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_498114bf625659e1b4fa648f4462127b_elex_emotet_stop.exe
Size 208KB
Sample260924-lfsvcssbmd
SHA256 60fe92ea2de301ee0a4d7d0b365f08547ccf92c726621980775af3fac66c1819
MD5 498114bf625659e1b4fa648f4462127b
SHA1 a0ffd726a60ace321203a3585d4b8fc0b161e6ea
SHA512 04035df3aae1fdc914391a070d81c7692f35333df4878d1cbfd9ac6b92bd4c87718ccd76fbd6a30f8834fb1dee6b12f76877785ed47e3602ee51dc7f78c1747a
SSDEEP 6144:MlZtbLWIgd1LZ9oECZbmZTyxu8BnQcrWs70kEj1:OLWI09QZbaTD8BF0kC
TLSH
T13A247C0236C6C072D573AB3048F59BB876B6BD51ABB2865F67443B1C6D325A1CB30BE1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	648	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-23_498114bf625659e1b4fa648f4462127b_elex_emotet_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-23_498114bf625659e1b4fa648f4462127b_elex_emotet_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_498114bf625659e1b4fa648f4462127b_elex_emotet_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 472
  2⤵
  - Program crash
  PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 648 -ip 648
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-0-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/648-1-0x0000000000400000-0x0000000000438000-memory.dmp