7ffc39a1e0e32ef3590881542f391c2bf9b284d3ae32dc47fcd006f5ed7bb7f3

Analysis

max time kernel
149s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 322KB
Sample260417-bval8agt7v
SHA256 7ffc39a1e0e32ef3590881542f391c2bf9b284d3ae32dc47fcd006f5ed7bb7f3
MD5 0f0c6b974704ab14239198a2c8d7de24
SHA1 d40ed95f9dd57939c475eac32735a6a1a1be54b3
SHA512 f47c233941599f4dbe1eae9c5f049b25bea2bfda6d8235a5ead6df980ba992af01fb81bae2329c025ab0766d1986d410eddaaa9122cd1109f143ae3822b9315d
SSDEEP 6144:GjuDOhVLOdnj+CPXIYj8Aco9SDe5JS3VO43d0iuW1FXEk:GaoVql+84YjcoUPn0iuWXJ
TLSH
T13E64590176C08F75E4AF043149B65A79967BFC301F2593CB6394BE0A3EB1AD1A936363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2476	armsvc32.exe
3576	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe
3576	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 2476	3716	2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe	80
PID 3716 wrote to memory of 3576	3716	2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2476
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
Size 493B
SHA256 41bf1a0ac518d6992a61adb4a88dba4f69af360dcd3f252ed10ba92d214be2b5
MD5 d1c2ba3858158bf130071448aff874c3
SHA1 60231ea1987748872884fa4beaaf3966fa3987a3
SHA512 774027d45f6c0e7ba1aad00103a6fde4208943c390d95dedade2c1e65dacf36760a905432e0d5f1446f294dd7cee4dada549c86d410c95f60d297255e77b4633
TLSH
T1BBF0C961A79C390327F03D1663C2D41FDD70528005807E4C22E0419468457F0A980ACB
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 80184dfacc27138e877c67098a7d0240c4774d6f7ff276d2a607ca32e1827a30
MD5 5e5f0dbca7605807dcc0718fe5909eac
SHA1 e76643624f3f5e19dd16140c99c5420941ccf39a
SHA512 a991d02742615e906b6f8f19290635402f1b8942fc5c2ef313f0faecc052d8a134ba9089128d7d6d62c3f1c6a082dfe5764de33a739a21c968d012a96ff5e8ad
TLSH
T19EC08C080E9A0226E14443BA012089021A209504F28BEF0E0BB22A580965F215810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 7d0195a8959c3115c4f66b0d3766b768010ca50b78241e5c6ce731f389b255fd
MD5 33759f66785a81148071134ef3956fb3
SHA1 c7b36bb26097f33c514d2f48810f09ce8773ff1d
SHA512 3cf21b90b16c796485aba704c0cfeee2f61c179af5234fca955461aa8577962c15f90b6ea78a580204b22796596509aea28f45fdea108b7f3c14b2958ab03f01
TLSH
T131E0C7012AA80204E5730A3CA87362089936B32A6A02CACD0235018D0C21F62C83271A
MD5 SHA1 SHA512 TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
Size 248B
SHA256 37b44cf2c437b4cf14c3ddd2106ea64cccc46989e1b6ea1aa0a7d3add6d2a9a9
MD5 b89a729832ba08bc10746fc4a823f774
SHA1 24bc92af4bbb4b9dcadc348628738ed4a9321e9a
SHA512 f682af2efd7f1b68ee0660fa716a5fba738035c673c4c9b6a6d18f34e0893ef5eeb48be23f4a9c207de139190797fd6a1faee81708aa68b5526734fbe624a314
TLSH
T162D0221E23A22216F07C837688918F0AAB30210374A08B06013B030DBC66E132C23C0C
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_0f0c6b974704ab14239198a2c8d7de24_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 322KB
SHA256 7ffc39a1e0e32ef3590881542f391c2bf9b284d3ae32dc47fcd006f5ed7bb7f3
MD5 0f0c6b974704ab14239198a2c8d7de24
SHA1 d40ed95f9dd57939c475eac32735a6a1a1be54b3
SHA512 f47c233941599f4dbe1eae9c5f049b25bea2bfda6d8235a5ead6df980ba992af01fb81bae2329c025ab0766d1986d410eddaaa9122cd1109f143ae3822b9315d
SSDEEP 6144:GjuDOhVLOdnj+CPXIYj8Aco9SDe5JS3VO43d0iuW1FXEk:GaoVql+84YjcoUPn0iuWXJ
TLSH
T13E64590176C08F75E4AF043149B65A79967BFC301F2593CB6394BE0A3EB1AD1A936363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 86KB
SHA256 8868ff76727c298bf62204ef9c625096290b80f8c8bf3f64f626960253abd88a
MD5 3ff5d044e56f2dc564f679e1557d25be
SHA1 0fd280679a67dce43fa334db658635ecf69a71e3
SHA512 a5d405c60739b8212bfe1c8ed17fa2d7056e2d252bce8b5f867021198abdf5961be18d3b9af0efbdb039d7cb08d8277ef8d84b128a62ec928afafcf1466022f9
SSDEEP 1536:BdVGulxRhAufHgorx9oXb23/HWVS3T4T5oqS3jhO43u1g3OzCkp:hY8AE9oXqPuSD4T5JS3VO43u1OOzCkp
TLSH
T1C0831901F7C19435F8B319B19EBA486A6629FD721319D0DFB2C95A4B1AF06E1BD31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 78b24eecad5149f76fa62fa97cd271eb5bc40fd96d733f9c7f66ce260600b2c2
MD5 8456b26d08f4affd22db1e379de58be1
SHA1 8f6e6e89bc53a86f07542c4c2ccfff39fdfff803
SHA512 a6e1a46d7fd604ecc0512e689e6ec86d42f9d62695a9d193f77a23e1f5b90fa79ddd114231de3ef06ff5caa0b383e0c30b30ecd48b1fadd14815350081d049bb
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6Pdnj+CB5XIYnQB:GjuDOhVLOdnj+CPXIYy
TLSH
T1CCE3491232D1CFB9E1AF45318DA29AB546B7FC319D3297CB13907E4D3E359418A2A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3576-10-0x0000000002100000-0x00000000021C1000-memory.dmp

Download

memory/3576-96-0x0000000000690000-0x00000000006A6000-memory.dmp

Download

memory/3576-114-0x0000000002100000-0x00000000021C1000-memory.dmp

Download

memory/3716-9-0x0000000002A40000-0x0000000002B01000-memory.dmp

Download