5d8632295aa1fb0c3f2c09894a0985ac1afc8f72a616c784e1b32f9313ae08a6

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_4a2cd8694a04499e553029c0b41da035_amadey_elex_emotet_smoke-loader_stop.exe
Size 816KB
Sample261011-sdtr7sbg42
SHA256 5d8632295aa1fb0c3f2c09894a0985ac1afc8f72a616c784e1b32f9313ae08a6
MD5 4a2cd8694a04499e553029c0b41da035
SHA1 19e2d0234c3655c552c65bda387e208a3c0b4840
SHA512 e192a6a8561a7ecfe5710b87e40bbbba98a0217eb6b644457ae2d9ecb45464de558bdc3529371f85d3e459298b1663195186df7f0afb155d0540dbfb2e3d8985
SSDEEP 12288:3Q3i10IpZM5ZGOOiKOVSnEILF0GlsHovwjEtZklMfoeQMghqv24oy03i:PZM5ZGx4VSnrLFY+iOOMAep10
TLSH
T10E05F11237D1C873E5A606B60DE68729A376FC61AB3186CB67C03F4E9DB07E69535301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_4a2cd8694a04499e553029c0b41da035_amadey_elex_emotet_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1704	2026-10-10_4a2cd8694a04499e553029c0b41da035_amadey_elex_emotet_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-10_4a2cd8694a04499e553029c0b41da035_amadey_elex_emotet_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_4a2cd8694a04499e553029c0b41da035_amadey_elex_emotet_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ljp1100inst.log

Path C:\Windows\Temp\ljp1100inst.log
Size 1KB
SHA256 5aa0b875bb50da9a07a8672cc895265129bb4e4b415e93da2690e9fe2bc8cc4d
MD5 67313de9458419f38759b9e0d5928e71
SHA1 8013a6e81e2d4996766f6c92793cf0281b5d2bcc
SHA512 ab60120e5e6b230e95141b8716ccfce589866384f845ceea21187454ed82c65481ab074bd22d2e60e92216378bc9a4ad3a746b7382177074630bfcf3105a8690
TLSH
T150415B80E79B0AAD0DB025F6132999DB66A3043E5632AB387F11C48831553FD23F7DE0
MD5 SHA1 SHA512 TLSH

Submit Download