31e8d34b79eed0939f0546a0f6db94e15e55e8dd021a3def8eae070856eb6170

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop.exe
Size 3.5MB
Sample260930-ffls6at12p
SHA256 31e8d34b79eed0939f0546a0f6db94e15e55e8dd021a3def8eae070856eb6170
MD5 1bb2143d955b35d8065eb0595cced5c2
SHA1 eacddfbace1dd26365e0d8e0cd8dc302277f2162
SHA512 f79cfbd6fd7c1212da317d54231d258acb7fd6bed8500987cc74e46a35131122668daa92467af944aabd739a5b731690f0d5012fd9473e2815d88db6f961fad3
SSDEEP 49152:76ps/Yps/RmQvepE+k71FCZKbEi1U25gmQvepE+k71FCZKbEi1U25Orrp:gqeqTWpZkBFZ7mWpZkBFZ7OHp
TLSH
T15E069D85F7D2607DD942017A4461CF3A8E22BC6A47B50AEBB3DCB7295F70AC04E37685
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4760	WdHdBridgeSetupX64_Payload.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WdHdBridge	WdHdBridgeSetupX64_Payload.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4760	1808	2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1bb2143d955b35d8065eb0595cced5c2_amadey_elex_emotet_icedid_remcos_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Users\Admin\AppData\Local\Temp\WdHdBridgeSetupX64_Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\WdHdBridgeSetupX64_Payload.exe" "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WdHdBridgeSetupX64_Payload.exe

Path C:\Users\Admin\AppData\Local\Temp\WdHdBridgeSetupX64_Payload.exe
Size 1.8MB
SHA256 6e62114e5e7677ac4b1663501610fd9f0b1faf340bad0404b0d6204fc8c93b27
MD5 153e617e45c86e34a210488d19543e74
SHA1 c410a67b916dfb1de2665610fd33debb4300cd1e
SHA512 b32342a5e7559a198a136192437720d3ad4ede1ab14bf2b68c02e33b46bd15a3fef6ea3777d02e6dad5f83ee3283db2622fd1f40ffec06dd420fcedace170286
SSDEEP 24576:FUAGupmloM9vmQvqjyVSpEiJkOE11KK/6ZfS8y5GiDWsy+6ni1dW2ke3:bps/RmQvepE+k71FCZKbEi1U253
TLSH
T1D9859E85F7D270BDD942017A44628F2A8F22BC6647B50AEBB3DCB7195F70AC04E37685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download