Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/04/2026, 02:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
- Size 418KB
- Sample260418-dcejkaft51
- SHA256 8f470f8f684e959bbce307b19ae98e48b2c72446b571f1aed13964fa72c506ab
- MD5 982976ca49de91cb8f23470af6dfaf0b
- SHA1 71b1fe7180e13b28cd228cf1f3942b087c86c47d
- SHA512 ae657462484f09a617e631a12cc1d37b7739973bd7c715182340f76363905cdc9f5c176926a16e9011d20da6a221aa1f32e457e7be3081ebf197e5542560f15b
- SSDEEP 12288:GaoVmp+84YWi3drBRy9hdFIdhoyYTiuWXj:GDVmpzSi/RyhdshPmiuWXj
- TLSH T150947C1632D44EF5E1AF403088615A75E773BC200F219BEF43A4AF69BE326909D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2828 googleupdatecomregistershell6432.exe 3968 eventviewer.exe - Loads dropped DLL 10 IoCs
pid Process 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File created C:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msosrec.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msqry32.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\office16\liclua.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvlp.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\mip.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msoev.exe eventviewer.exe File opened for modification C:\program files\internet explorer\ieinstal.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File created C:\program files\clearformat.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\keytool.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\orbd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\policytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ssvagent.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\inputpersonalization.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\policytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\tnameserv.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\common files\microsoft shared\source engine\ose.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\jp2launcher.exe eventviewer.exe File created C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excelcnv.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\iecontentservice.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\tabtip.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\os_update_handler.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msohtmed.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jarsigner.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ssvagent.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msotd.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe 3968 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3388 wrote to memory of 2828 3388 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe 85 PID 3388 wrote to memory of 3968 3388 2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_982976ca49de91cb8f23470af6dfaf0b_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe"googleupdatecomregistershell6432.exe "2⤵
- Executes dropped EXE
PID:2828
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 734B
- SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
- MD5 417e1515abb2c4c688717634bf70377c
- SHA1 b02330861433775b10e7ae74557911aa623c7fca
- SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
- TLSH T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
- Size 493B
- SHA256 17771b9ffd78504f40f0cbaae897bf99ad95641a0748fdf550f8779b00ffe302
- MD5 116c10894ac3a0e6bb0a337ea4d37c08
- SHA1 4a1a4776f8c39fd1eddca87f1387fbbd4200f910
- SHA512 63c8594a923a30819c012869d8ce40f427c31e7f8fec0405129a8d73f177b3933d2d35f3da3c88fb391dc5426b08a44bc0cc5b4b598e2654d44e84694838bcef
- TLSH T1F0F00EFB56A86A182AF07D9F67C8D40B5AB8BBCA0410BB91166C4194E808BE0EC44B03
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 293fadfe812f7cb7a4faaa702c25706e110b2f91c0af6da136b3a67f571c8339
- MD5 68e8839a1f4476049b5ede50be87c0b3
- SHA1 9f73704b318380bd8300c0e2c3b7ed605b10bad4
- SHA512 4927d34b67fb3365a01dcb241022844d1342f7ab5bf97e3fed2db77598904c9a4323ca9f3da4dd315d88c411db362fdfdd0a6a7daacf3326854d552718f25543
- TLSH T1EBC09208AF660326E34923BB813102425950A501E1E68B4F08B6266C4A66B122A21EAA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 f8ff0c24a0b0a0882f02eb347c0b37b2ed50e47a4b84a42c16a82dae4216d2ca
- MD5 3ff1fdc0fa838072a3b19cd672530c41
- SHA1 e68d170e38adb3795ae61cd383710a0bf466e9b9
- SHA512 be6aafde92c50549df53d32754b9361296866b3a0d1fa795d1442b5556d5933068fe11a4e4037446737ef7903a903e8c85378e313f782b1b184c6be30a214d49
- TLSH T110C08C080E9A0325E24513BA013089021A109404E2CBEF0E0EB12A680569F211921CAE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
- Size 248B
- SHA256 711db13652c120f34a8276f6b53ca2c62be0081b655bb6a2fb98d4017ac5c065
- MD5 f9686387a320751afd58264b8124295d
- SHA1 cf77705f5d37c54e492030821ab19e120b9fa0d0
- SHA512 c12da09fee3230504e644a1bddfaabb656bdc37f4280ea540066a2ff8d87c9e091a5a7ff39fbbe0bcf5e71bca72100f6eb7eb5a31d37d97d8274b3c2b2828e8a
- TLSH T1E7D0801837720366F0B9413B94FD01434D55711270A14F4B0465134E5C56D051C92D2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
- Size 181KB
- SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
- MD5 c2c0992a4565b32faf92cb0b21765ca8
- SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
- SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
- SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
- TLSH T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpF047.tmp
- Size 152KB
- SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
- MD5 dd5645a32ccec6b1fd23a936699bc3d4
- SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
- SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
- TLSH T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH