48aeb73491a1b3882b18b4bc5744afec8962ecccf1dde7899ab2263be5c07352

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 322KB
Sample260420-e8ygzsc12v
SHA256 48aeb73491a1b3882b18b4bc5744afec8962ecccf1dde7899ab2263be5c07352
MD5 a230deaf44e273323153e4ad4c4458ca
SHA1 fa5a3bc9984e245fca917907b502f94c260fcb3c
SHA512 604abe22143ccecd67cc64cab85b12debe6861bdf3bba01ec506db98059b77018cf174565b867d0b00cf43dc26e8311af43c93557cff3f222bafbba0f72a9b1e
SSDEEP 6144:GjuDOhVLOdnj+CPXIYj8Aco9SDe5JS3VO43d0iuW1FXET:GaoVql+84YjcoUPn0iuWXO
TLSH
T11064590176C08F75E4AF043149B65A79967BFC301F2593CB6394BE0A3EB1AD1A936363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2744	armsvc32.exe
3716	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4204	3716	WerFault.exe	85
2648	4652	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3716	eventviewer.exe
3716	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2744	4652	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe	84
PID 4652 wrote to memory of 3716	4652	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 1904
    3⤵
    - Program crash
    PID:4204
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1592
  2⤵
  - Program crash
  PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4652 -ip 4652
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3716 -ip 3716
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 210KB
SHA256 238bf1904d1abca7e9c3263b4ef3999d9753f5b2b5faf9d009f1d5f4b46d406f
MD5 9831fe81f577f3e3b54cd0f919b9446d
SHA1 206122381e5b8140f9f49ac88fedd5cf75da338c
SHA512 5567d5da779a05368c2b7ff916f0a1164bc70019fdc132d6109ae461cec69334b845f222fe2f15f8c922ac6c5daa512f7359ed5585502c14582f29f8b576a94f
SSDEEP 3072:uhD1gpu1K3x5umdOxe0Yau2SFiSzjXZyKBiEc+AKL:uhD1gsg31OxvOBwKL
TLSH
T14924F8689CB7F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A97DF53400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a19157f9b44c541d54dcd917c44157e04ae0d5fae91ab84c898c62e76c9cba3d
MD5 29a4bceb953d0336195ca54a9d52a61c
SHA1 5746bff726226955a02c3949dd56777cdea156ea
SHA512 ebeccd31c6a724dac8e7f27e24b57230f3d6f3331f2d06e5f5becd55d9b0c8ccc55c5ee4c77aedbd0f31399839cd2d752e5b8e93a62c75ec42d039ce0a2c3b89
TLSH
T167C09218BF660326E24803BB813202425950E501E1DA8B0F05BA26584A63B12A920EAA
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1444fb5dff8907864dc2e07d4c3b8f1d20527cbf7ad426cf088daad7f4c58f6c
MD5 63969fcd7b4dbf36ef671af43682c2b3
SHA1 521be3c6a96362e5c94f1dd9e0fb02507a66b4a2
SHA512 8e1dc5fd59128bf2d0430db732e71ec4966dfdaa98dbd9d8287b9969b338837b5f7a7ae6f3e054a1a0881386ed0cb88326bf00ebfe4204e517f558810613c165
TLSH
T190C08C186E9A0225E14803BA41308A021A10D404E28BEF0E1BB52A580966F219810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 1e761530bd256e2541bfa63566c988e178fb0720a0df33bca43b465d72eb4d10
MD5 05d0e44cc7b5ccf9f8583727b5a891ac
SHA1 7d2f1fc4703bd1108b897d0495a6dcabbeaa4f20
SHA512 576ae0bafa69a5e40ef21e631e6bb84a353e1a6c4db6c78327a1855bb151ee440f3d3b60c9b6bfe4ff88a52021b5c7a9a45a9543f69ac64e01b2dcb59ffb9540
TLSH
T13BD08C392FA01636F06C833B9430020888A5A422B4F18F0D1065861C6C33F539C62D2E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 aea63efc46c1ddeafd5e29351564ae75340370ab7cf0b0ca4df46961ccaa2d1f
MD5 993f292f064bbcc41c25b99ae3efb461
SHA1 98ad0c699e505194220b850b2b88c8e640d5a51c
SHA512 eeeb55ae9b9f6ed04b84187eb88bf4ee9149963453d2a227fa4678a105ddec5e926dc8263c69fa8178494e57aa2b075a91756d9e96d27a4e71b406b5509509c2
TLSH
T1E6D0123D1FA10636F26DC3369420061495559523B5F19B1D1169C62C6C72F52ACA692D
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 86KB
SHA256 8868ff76727c298bf62204ef9c625096290b80f8c8bf3f64f626960253abd88a
MD5 3ff5d044e56f2dc564f679e1557d25be
SHA1 0fd280679a67dce43fa334db658635ecf69a71e3
SHA512 a5d405c60739b8212bfe1c8ed17fa2d7056e2d252bce8b5f867021198abdf5961be18d3b9af0efbdb039d7cb08d8277ef8d84b128a62ec928afafcf1466022f9
SSDEEP 1536:BdVGulxRhAufHgorx9oXb23/HWVS3T4T5oqS3jhO43u1g3OzCkp:hY8AE9oXqPuSD4T5JS3VO43u1OOzCkp
TLSH
T1C0831901F7C19435F8B319B19EBA486A6629FD721319D0DFB2C95A4B1AF06E1BD31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 104KB
SHA256 81319e7b7db8b49fdfdb593657d967a6fd1a69344c75227e7f597cf418ba6ff4
MD5 f35b818ca51576e62a33c1cc8f5515c6
SHA1 5f61f9d078694f493d7b69f5c124352f6fd9442c
SHA512 954582de08d4b57799aabfccec0ee36175d5c49180ab427bc89d395e897e4cccfc755168ef450651e7c1d9937e072ee2e3828dbbeded1fd69da203c1421a3640
SSDEEP 1536:zJqwy75UhKasJY9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:YDwtXphLMZ+tH
TLSH
T1B6A32B7163F00ABA60C343A47B647A597E95D18BE113C0DCB3BE56516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3716-28-0x00000000022B0000-0x0000000002337000-memory.dmp

Download

memory/4652-29-0x00000000023C0000-0x0000000002447000-memory.dmp

Download