c99dab59556375b358e22e08b038ed844419ffacef38807d6f5b81f47d262546

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample260420-e5xfhscy9z
SHA256 c99dab59556375b358e22e08b038ed844419ffacef38807d6f5b81f47d262546
MD5 9c73fa68d102adc89ada8bb84e741090
SHA1 7c2200417f7cc7cb82e603b4cf589544f0988612
SHA512 71214fb9eea9afcd79bd50f374b4daea0bf5745d5cc006465cd7ee229fcce6848d8ddc5b5b3496987a3e822788385260539fcd593fbbd8a634bac38a77509bb2
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXEo:GaoVmp+84YgcP/aK2vB+WiuWX1
TLSH
T12584381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4548	googleupdate32.exe
4628	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5744	4776	WerFault.exe	79
2968	4628	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4628	eventviewer.exe
4628	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4548	4776	2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	80
PID 4776 wrote to memory of 4628	4776	2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_9c73fa68d102adc89ada8bb84e741090_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1544
    3⤵
    - Program crash
    PID:2968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1464
  2⤵
  - Program crash
  PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4628 -ip 4628
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4776 -ip 4776
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 210KB
SHA256 ea1a956b0264a2386d947b659a06e3ed95240455cfca87fe4c2813466f6a7bad
MD5 bceb42259faf346b0b8620bff9fb01ae
SHA1 d852c6f8a3579df5ebd1ed01075aa1c23a3a1890
SHA512 50ee99796e691b394e48dfebda6620e828fb2587500f7238acf9d880394f03112fe50f1596a65bd18b3f71a42c2c6b1f5246dc5e4246590e7013cf3096aa000c
SSDEEP 3072:fhD1gpu1K3x5GmdOxe0Yau2SFiSzjXZyKBiEc+AKq:fhD1gsg3NOxvOBwKq
TLSH
T12824F8689CB7F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A97DF53400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 89316df3c5cdaa9574f666621adab7f28a3ef8148f0b0c33081f2783b4595007
MD5 a55133d7c6ba34d393712108c4d385f0
SHA1 2b4ece7d0ff5aeee1b858c176e29d098f8b67713
SHA512 2f92b60780c12258eb23ebfcc08d9ea959822feca33438a3e87a7ee2291dd56d5493f6d683355e1caee937bfd545094b4ece8ee75e5c54a3edd03d99e838926f
TLSH
T106C0920CAF67032AE14807BB8531124269A4A501E1958B1F04B626684A62B122920EAE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a8586f9aa170d1275b30c727ee40d1a6eaea462bb41896f3a751dd17c57a4238
MD5 070b09a2a507ccb722c91dbe487c4569
SHA1 25515ef22147c22590943cddb551f6f01b9f86b4
SHA512 a7051beba2e079bfe811509642db7fac643289df7668c905416555e319cd74eb1ada276fad9607946ae0e131a7018a23471cfd96b44d311f54dc383660298a21
TLSH
T1B4C02B0C4F9B032AF04403BB41309A022A20D404F28BFF0F1FB12A680565F312810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 da4d874b1928ba2d579a3a66167a1aabe114928bbabe9b53570656de0c279d99
MD5 839398f4c0d5d0157d23da95b4df7704
SHA1 e6af754d2146b1ac541f25e7b682dd26b730e09b
SHA512 cd8509998bb51a73be8534e14a1c9fd6eb98f583b0ee43def16ad5dabde927138e8ae007af02b5e2917e2b86cd1c0c9879c356f69a0b1c09dfe4ff82f57d7e7a
TLSH
T159E05E126BE80204F5770A3CA8737645997BB76B6A51CADD1275008D1D22F61C933719
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 8fb058dfd0665406829f69ad382dd1663112bc79e550d8438a88f0ef95cc85b9
MD5 a95f56155b87435eb2b9b0c342f8e817
SHA1 a0f75169416081b2cb73c13cad8325379b029d57
SHA512 ebf7cd7bb52e8232c4d360d5939444aec81a9523e3223f65e5cf006403d50656a84a49b49d2dd66c77a7503337e0db843cd66895ee4e930a1c6f99bf8f082545
TLSH
T113D08C0E0F950A2AF4A5C63784B202C25AD9A812F2B1CB0F12FA524C58369822821D0A
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 104KB
SHA256 81319e7b7db8b49fdfdb593657d967a6fd1a69344c75227e7f597cf418ba6ff4
MD5 f35b818ca51576e62a33c1cc8f5515c6
SHA1 5f61f9d078694f493d7b69f5c124352f6fd9442c
SHA512 954582de08d4b57799aabfccec0ee36175d5c49180ab427bc89d395e897e4cccfc755168ef450651e7c1d9937e072ee2e3828dbbeded1fd69da203c1421a3640
SSDEEP 1536:zJqwy75UhKasJY9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:YDwtXphLMZ+tH
TLSH
T1B6A32B7163F00ABA60C343A47B647A597E95D18BE113C0DCB3BE56516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4628-34-0x00000000009D0000-0x0000000000AE2000-memory.dmp

Download

memory/4776-35-0x0000000000AE0000-0x0000000000BF2000-memory.dmp

Download