0042d17099bd3d7c1b15c99a7ef77663ffc624eafafaf4db5936b0313a771ba4

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260422-dtmlhabz3x
SHA256 0042d17099bd3d7c1b15c99a7ef77663ffc624eafafaf4db5936b0313a771ba4
MD5 275e70f988f7604109611c258cea2bdb
SHA1 58739af28776e286761009a32e68535208b39f07
SHA512 c1af88d90dfd974e5efdbb9dfa233e316b9453d6fdead4449a9a6427136f46bacdee07665b8dee296da2a8413d4be14a0fac6c49300e3d1c42f5ab7e6c05edc1
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEq:GaoVmp+84YAIkOkTB+weaiuWXf
TLSH
T153747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3972	microsoftedgeupdatebroker32.exe
556	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
976	3748	WerFault.exe	85
844	556	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	eventviewer.exe
556	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3972	3748	2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	86
PID 3748 wrote to memory of 556	3748	2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_275e70f988f7604109611c258cea2bdb_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 1732
    3⤵
    - Program crash
    PID:844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1792
  2⤵
  - Program crash
  PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3748 -ip 3748
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 556 -ip 556
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 204KB
SHA256 f531f67a9bde54c6c8a3277a136417f44fc8ef18f9cddadf36150a83902266e4
MD5 a8331456c09a206eabcb15cff987ec96
SHA1 8597d584fd063d53f70d232b0e9a4f82552d3b80
SHA512 d95c256581cb0a9012021685a7d341761646e27361b33b226b9d868bd7ac4afc256ee643dd731f68a64bf722dec1ea5086b3c478d48b12b7c9cf32b5e365b96a
SSDEEP 3072:acXdu1Kax5dLY2Ge0Va02m7imzjXZx1BZ4mOwtR:acX4gai2G66GmtR
TLSH
T164241A686CB7F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A97DF53400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ddd75c259b8bea49b6695b39c5e936688ff47c0167ac65eb85b7487e1899b499
MD5 1f1859a03e706216a76dc0f325800991
SHA1 95921b5c33d84d5f4e41a905c0851b8c2e5ec37d
SHA512 44e9adec451795005ef4fe879e4e34614ee439bef34ad5278070428baeaf4ff6f0dad1482bf2c0e52ab99a5749db3ea320b3a7c6b7aced15d2f9a51dece50b4e
TLSH
T15DC08C0C0EDA0225E04403BA012099022A10A414F28BFF0F0AB12A980565F315810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 4e729f36b5909af673c7363c5451d8d5a5bd1c307b25310708d8dd5c50fc730e
MD5 dd341cc0b0a545eae9caee66989c2582
SHA1 87e8c6e1565842dffc76e0e538951429c34f8816
SHA512 b4b26f4728e34988561cd5092f562255ae90c5090bc7828bd0c09528b7849967692af93eadd14457dd78280b0dd6b898241ae5e23878d5b329df349bfd5109e5
TLSH
T129D0A9640B930A30F0A09A36B8700001AEE01A22B1F0670A01B2848CB432E071E2280C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-18-0x0000000003270000-0x0000000003289000-memory.dmp

Download

memory/556-17-0x00000000031C0000-0x0000000003256000-memory.dmp

Download

memory/556-28-0x0000000003270000-0x0000000003289000-memory.dmp

Download

memory/3748-16-0x0000000003150000-0x0000000003169000-memory.dmp

Download

memory/3748-15-0x00000000030A0000-0x0000000003136000-memory.dmp

Download