796c751a96052778f786edffe5962ef5cfb7c8aea3283b378d8cdd11c74012d6

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260417-e6hzhsaw2y
SHA256 796c751a96052778f786edffe5962ef5cfb7c8aea3283b378d8cdd11c74012d6
MD5 b184cf0f3c06d3628169c31c63708e41
SHA1 6a316e5a40508879c1685455a5519a74777625d8
SHA512 921d9f6ba8888f54716698fdf90376e3e0f91fbf4387c2ebfcfad28acd60405253b5ea54257fed50faf5e3b2c671b78a9e0f84145b73052a1bfc9fcab71c9560
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEw:GaoVmp+84Yb4lssmroCkiuWXt
TLSH
T16AA45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3960	microsoftedgeupdatecomregistershell6432.exe
1428	eventviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe
1428	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 3960	3084	2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	84
PID 3084 wrote to memory of 1428	3084	2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
Size 493B
SHA256 764b1878908d189826b98dd114989414de3251aecef600d0c17d0227ae16f30c
MD5 827189a65b8cca87b3117a61c325585a
SHA1 c106e27a3116c05fdf28fa84379fc3afc013733e
SHA512 3b3844520afb7a36aca1d6b35b9d9e186389f4a7a185e8649f0cea436ee2c619136b6367513b474062ce480bed873dedf8a1c0b5fd96c0677c4795a49f76911a
TLSH
T196F00EAA6B616B2726A01D06D386EA025DBAA0DA0D04AE7500C511D8FC457E0A5C4506
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d755ecf165481c4256f248da7b8835cb880614c805688bc51e324478ccd096f9
MD5 97410f91c43450f5a5fd4fa9b27bcc8e
SHA1 7bd9b8ff9c7b35c0d4866bb1dbc610fe4349820d
SHA512 7b6839e181e9223ddb5c19b82cf6b187354b81be49b863a0bce743146390892ee79c1b07d064eae234bab90c65d5584ab9fcf65422b06f1b8554019a2ab69738
TLSH
T1D3C08C189E9A0225F14803BA01208A021A10A504E38BEF0E0BB52A990569F311810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
Size 248B
SHA256 bcfb5058fe70985d74fd85968eac0b28312394abd5d93c83bf03c4e9d13894e4
MD5 397500d4d5d858ba95ef4ef742f4d0c3
SHA1 d892a0dcaacc14fb1dabc51272b4fa22ba961731
SHA512 59f1f06ae06aba9d3306a587d8ebd59e598f7beb782aa27f9aa9d1fb7c5682b419f9dd3f3ca7337b4c77fc43ce3430169eacb6026c5cfc302d90fc74edcb0fb5
TLSH
T10DD0122877192235F1BDC33A99665712EF20621776714F4B15B71D4DA8A6F031CA1D0E
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_b184cf0f3c06d3628169c31c63708e41_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
SHA256 796c751a96052778f786edffe5962ef5cfb7c8aea3283b378d8cdd11c74012d6
MD5 b184cf0f3c06d3628169c31c63708e41
SHA1 6a316e5a40508879c1685455a5519a74777625d8
SHA512 921d9f6ba8888f54716698fdf90376e3e0f91fbf4387c2ebfcfad28acd60405253b5ea54257fed50faf5e3b2c671b78a9e0f84145b73052a1bfc9fcab71c9560
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEw:GaoVmp+84Yb4lssmroCkiuWXt
TLSH
T16AA45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp5346.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5346.tmp
Size 152KB
SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
MD5 dd5645a32ccec6b1fd23a936699bc3d4
SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
TLSH
T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
MD5 c77a7e16f85637827514b13d5b586f76
SHA1 05775016364462afafccc226268373de15956815
SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
TLSH
T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download