48aeb73491a1b3882b18b4bc5744afec8962ecccf1dde7899ab2263be5c07352

General

Target
2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 322KB
Sample260420-e8ygzsc12v
SHA256 48aeb73491a1b3882b18b4bc5744afec8962ecccf1dde7899ab2263be5c07352
MD5 a230deaf44e273323153e4ad4c4458ca
SHA1 fa5a3bc9984e245fca917907b502f94c260fcb3c
SHA512 604abe22143ccecd67cc64cab85b12debe6861bdf3bba01ec506db98059b77018cf174565b867d0b00cf43dc26e8311af43c93557cff3f222bafbba0f72a9b1e
SSDEEP 6144:GjuDOhVLOdnj+CPXIYj8Aco9SDe5JS3VO43d0iuW1FXET:GaoVql+84YjcoUPn0iuWXO
TLSH
T11064590176C08F75E4AF043149B65A79967BFC301F2593CB6394BE0A3EB1AD1A936363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5176	armsvc32.exe
5016	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe
5016	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5176	5100	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe	80
PID 5100 wrote to memory of 5016	5100	2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5176
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 83b0c6ef16932d55d56deee05b91645e0f03cd8eac9da26d25c3b3b53eb55834
MD5 764036ebc7f1e1be162b525f44d67a41
SHA1 f0a352b37bfccd17a57fcc4cd42ae4ba832a331d
SHA512 0fea110afa096e97bb993b2bcbef164fc6bfc7c96afb0d90fc58dd5a03c001a3e81ce728e074e4d07fccf0f528a6177e5e1c01463c83938bc7764d02eb0ffb59
TLSH
T1A9E05E112FE90205F6770B3CA97366459977B76B6A51CBDD0279008D1C21F61C932719
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_a230deaf44e273323153e4ad4c4458ca_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 322KB
SHA256 48aeb73491a1b3882b18b4bc5744afec8962ecccf1dde7899ab2263be5c07352
MD5 a230deaf44e273323153e4ad4c4458ca
SHA1 fa5a3bc9984e245fca917907b502f94c260fcb3c
SHA512 604abe22143ccecd67cc64cab85b12debe6861bdf3bba01ec506db98059b77018cf174565b867d0b00cf43dc26e8311af43c93557cff3f222bafbba0f72a9b1e
SSDEEP 6144:GjuDOhVLOdnj+CPXIYj8Aco9SDe5JS3VO43d0iuW1FXET:GaoVql+84YjcoUPn0iuWXO
TLSH
T11064590176C08F75E4AF043149B65A79967BFC301F2593CB6394BE0A3EB1AD1A936363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 86KB
SHA256 8868ff76727c298bf62204ef9c625096290b80f8c8bf3f64f626960253abd88a
MD5 3ff5d044e56f2dc564f679e1557d25be
SHA1 0fd280679a67dce43fa334db658635ecf69a71e3
SHA512 a5d405c60739b8212bfe1c8ed17fa2d7056e2d252bce8b5f867021198abdf5961be18d3b9af0efbdb039d7cb08d8277ef8d84b128a62ec928afafcf1466022f9
SSDEEP 1536:BdVGulxRhAufHgorx9oXb23/HWVS3T4T5oqS3jhO43u1g3OzCkp:hY8AE9oXqPuSD4T5JS3VO43u1OOzCkp
TLSH
T1C0831901F7C19435F8B319B19EBA486A6629FD721319D0DFB2C95A4B1AF06E1BD31323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp3908.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp3908.tmp
Size 152KB
SHA256 a8d1a293e16b2554345f76fbc511ee896204b0ba7ce590e4aea4be950fd2d55b
MD5 0623ac4453e11dacb7e27664a825804e
SHA1 8119784541ac11c8c6f236e95da1ffd2e8e8b49d
SHA512 581e7f2fbc81f4c74c9c09cc2650385a30d1d78636c128bc3fbd193cb9f69d8a39d05f96a52117c2791739a295566ed8dbf962494434b8c0dc9a4597ed29566f
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMPdnj+CB5XIYNQp:ujuDOhVLA0dnj+CPXIYw
TLSH
T1EBE3481136D1CFB5E1AF44318DA25AA44BBBFC325D7297DB53903E0D3E319418A2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 78b24eecad5149f76fa62fa97cd271eb5bc40fd96d733f9c7f66ce260600b2c2
MD5 8456b26d08f4affd22db1e379de58be1
SHA1 8f6e6e89bc53a86f07542c4c2ccfff39fdfff803
SHA512 a6e1a46d7fd604ecc0512e689e6ec86d42f9d62695a9d193f77a23e1f5b90fa79ddd114231de3ef06ff5caa0b383e0c30b30ecd48b1fadd14815350081d049bb
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6Pdnj+CB5XIYnQB:GjuDOhVLOdnj+CPXIYy
TLSH
T1CCE3491232D1CFB9E1AF45318DA29AB546B7FC319D3297CB13907E4D3E359418A2A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5016-70-0x00000000022E0000-0x00000000022F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads