emotet | 412ddcb23d091f9f344f4ab89655d68f4a4c00f27d157a79237c7aff59b5ff9a

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/10/2026, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
Size 172KB
Sample261019-acw7tsdb53
SHA256 412ddcb23d091f9f344f4ab89655d68f4a4c00f27d157a79237c7aff59b5ff9a
MD5 b32e187df616ef1c70f23f5b4e853840
SHA1 9d5eb0fe06011d8c426e4e4cd8089fe145af7bc0
SHA512 aacd570ce70414899c1d31277fd9989367073955baf3aec59b1a06fe875a75e8e5b29c28a81d35f92b8f64f21baa05525c9b0d771c12af5fe22f216d4ecd9482
SSDEEP 3072:WIaEnsFb3klMchKIFZnKTj8wRAYmRI6UdNuAjN25r2:WoYb3kOchBFBWZNmRIvvMq
TLSH
T15E04E1137413006FE665847158AB0BD952F9BC261B8196EF83907E6FBC3A3E19D3272D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery emotet trojan

Malware Config

Signatures

Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Detect Emotet payload 1 IoCs

resource	yara_rule
behavioral2/memory/1136-4-0x0000000000400000-0x0000000000410000-memory.dmp	family_emotet_v2

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89
PID 2132 wrote to memory of 1136	2132	dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe	89

C:\Users\Admin\AppData\Local\Temp\dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
"C:\Users\Admin\AppData\Local\Temp\dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
  C:\Users\Admin\AppData\Local\Temp\dhl_paket_008476892048572654091_set_identcodes_do_lang_de_idc_2042141043237.exe
  2⤵
  PID:1136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-4-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1136-2-0x0000000000400000-0x0000000004280000-memory.dmp

Download

memory/2132-0-0x000000000040C000-0x000000000040E000-memory.dmp

Download

memory/2132-1-0x0000000000400000-0x000000000042B000-memory.dmp

Download