94918a8abf1362b91a5bf2d5867865d2b0a25735d9f749b9724ad8e18de68de7

General

Target
2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 570KB
Sample260418-vs5t5adv2m
SHA256 94918a8abf1362b91a5bf2d5867865d2b0a25735d9f749b9724ad8e18de68de7
MD5 67f7186ae0a331008c34248b5a50ca7b
SHA1 bdf2a2e75725c5f111a36db9f89d38e549291dcb
SHA512 39d091e3440a5f3ea77d0150ebe03f406df70daad433950d788a3cea546137e088a574db54218b68d3f9a65e5c6f985de6981032d006c1703bdb0208d3d0265b
SSDEEP 12288:GaoVLa4Yd8uxQXygjzqU/2Jg5V2oiuWXj:GDVLa5MygjzdvZiuWXj
TLSH
T1B1C46C1173F840B4F5B7663489728625DA77BC665B30C68F13688A6D2F73A809D39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1680	dump32.exe
2348	eventviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe
2348	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1680	1908	2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe	80
PID 1908 wrote to memory of 2348	1908	2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\dump32.exe
  "dump32.exe "
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_67f7186ae0a331008c34248b5a50ca7b_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 570KB
SHA256 94918a8abf1362b91a5bf2d5867865d2b0a25735d9f749b9724ad8e18de68de7
MD5 67f7186ae0a331008c34248b5a50ca7b
SHA1 bdf2a2e75725c5f111a36db9f89d38e549291dcb
SHA512 39d091e3440a5f3ea77d0150ebe03f406df70daad433950d788a3cea546137e088a574db54218b68d3f9a65e5c6f985de6981032d006c1703bdb0208d3d0265b
SSDEEP 12288:GaoVLa4Yd8uxQXygjzqU/2Jg5V2oiuWXj:GDVLa5MygjzdvZiuWXj
TLSH
T1B1C46C1173F840B4F5B7663489728625DA77BC665B30C68F13688A6D2F73A809D39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dump32.exe

Path C:\Users\Admin\AppData\Local\Temp\dump32.exe
Size 333KB
SHA256 16f413862efda3aba631d8a7ae2bfff6d84acd9f454a7adaa518c7a8a6f375a5
MD5 a92669ec8852230a10256ac23bbf4489
SHA1 4bed038c66e7fdbbfb0365669923a73fbc9bb8f4
SHA512 86b2795a428799b1024c84cdb76eda787ade15d6895113a6e2c8db1635574fc48d5dbbe17b127f8bcc1ea092c19d9e215cefc8985c18a0fb0910e4548eb544ed
SSDEEP 6144:5ulvQXyijj2FO19VXUjUGTFqxnf85DAK/THw5+VUQwnKK5V2Ax:5uxQXygjzqU/2Jg5V26
TLSH
T14174185573F800E8FAB3AA3899728505DA777C565B34D78F0368416E2F73A809D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp13EC.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp13EC.tmp
Size 152KB
SHA256 53d17a488db88d5878a1e47f2896718cb1eccd11da5e449a51976514c3bcf1b8
MD5 1432bc856edc225f3f837230225d47ff
SHA1 fd0109512d4063687acc7c526301e4421d47d702
SHA512 61a1b0c8bf7c4f311a0ddcc2d9a4fbcea507fc90d7edf2b8351a7f2348ee37e7e3114e58436ceae4a8d517383f32b49dac7a3c507513778b8020e3925a55e8d4
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMGfnOssP5XIY2MpQp:ujuDOhVLAFfnOsUXIYnU
TLSH
T17EE3AF1136D08473E1BA16314D37ABA5C77AFCB65A72860B9760BF9D3C345808D2A7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 295d42622eaa9a87aa3825f696c9b6bc29d1eb8e17d3ec657e48388c61dacc4e
MD5 25b303fa513b5f83e0139c9035050912
SHA1 eebcbdb9f68bebb2c75093129bbb188e189a8917
SHA512 509ef53730ff4aa426ec53342312104a951b2bf0fd7657d7b6afc556aceb1b01e1ea668c6499a783262ae6a3351bf7ad45f8ba7cd8cefbd5b5404b6775739666
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQB:GjuDOhVLPfnOsUXIYds
TLSH
T14FE3AE1136D08477E1BA16314C37AB65C776FCB59A72860BA760BFDD3C349808D2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-11-0x000001C256ED0000-0x000001C25767E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads