c9fc5a201ee36e5eb81c19c0700bda9ca33461df3ddbe7dbf18daa58ad04407a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
Size 261KB
Sample260930-pr1k5avx2n
SHA256 c9fc5a201ee36e5eb81c19c0700bda9ca33461df3ddbe7dbf18daa58ad04407a
MD5 3028138e6817256b2702726a541480f4
SHA1 83223059d92d2fd03c670434bd01a250ac11e604
SHA512 fa3e48acb4510e3f42b4ed3714bfdaf83e94041388ec0cd18b78c71a808b5b21772a9cf6dbd32ca2cd1eca8c21408353f8cf45e2b62b45bdc22a261ad819b01f
SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T1F5446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3232	managed.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\requires\managed.exe	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
File opened for modification	C:\Program Files\requires\managed.exe	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	managed.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3312	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
3312	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
3312	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
3312	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
3232	managed.exe
3232	managed.exe
3232	managed.exe
3232	managed.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3232	3312	2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_3028138e6817256b2702726a541480f4_elex_emotet_icedid_rhadamanthys.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files\requires\managed.exe
  "C:\Program Files\requires\managed.exe" "33201"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

managed.exe

Path C:\Program Files\requires\managed.exe
Size 261KB
SHA256 c5959ff35ba9c2392be1eee8113bcfe734f82750405d035eefc41e2c96ddc5d2
MD5 187c0806334a4e50f4cbf9268f34fab5
SHA1 805b912fae51bc2560d7c5e046deb1bf1adad1df
SHA512 e15c2712b518171b35ebfd28bb77390bd45323487beeafd2167126dcdb237380001e37584374c82ed42a8244530792140678357ef600d9f00bb922028516848e
SSDEEP 3072:uD1UfR+uu3ZseyeEtNEjo4JdvzfPDCvu3Mn56/W9LTN5InzoSplU8OwD:y1Up+u7ftOjldvzjDu56/WF/jaO
TLSH
T194446C2232E0C873D1A321754EE68BB9B3B6FC204E76C64B23D43B0E5D756D25636396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download