8e32217cd0433dcb6b0271f1c333b858b0d2c131fa37bffa772ae6d853c52e30

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260424-dalvvsdt61
SHA256 8e32217cd0433dcb6b0271f1c333b858b0d2c131fa37bffa772ae6d853c52e30
MD5 f54061ee128ff6379a1e37596d225a29
SHA1 e31a8604a9c7ff382eabf9ad896ef0eaa7e69f7f
SHA512 96226797b9e1d8675669831785677713ce1eeb6a826f9deb1d04874134362accc4948442c94d010a7b8c36313cfc8de735ddc0d12724469cc877a9c406ff13b6
SSDEEP 6144:GjuDOhVLS5nj+CPXIY8EXAe6QPqksB+EYDiuW1FXEK:GaoVmp+84Y82Ae6D1B+EYDiuWX7
TLSH
T111747C1136D08FB1E1AF443148A59E748BBBFC304E219BDB63947E2D3E31981DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5076	googleupdateondemand32.exe
2236	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2520	4228	WerFault.exe	78
4416	2236	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	eventviewer.exe
2236	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5076	4228	2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	79
PID 4228 wrote to memory of 2236	4228	2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_f54061ee128ff6379a1e37596d225a29_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
  "googleupdateondemand32.exe "
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1552
    3⤵
    - Program crash
    PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 1656
  2⤵
  - Program crash
  PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2236 -ip 2236
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4228 -ip 4228
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 204KB
SHA256 7cec141c3c5efde61c0180c350806bbe303bf1424b60df9310f9a4416bda3872
MD5 c77c74fa3d17db3d203bd13a9a8844c8
SHA1 2a9bc6fabfb9497f1c78b7ba559e9eb2dfe2f120
SHA512 a5651a50272f6fb3cdd24108f9b880034d5c9a130d15ae85ea2326ed002c47928abca708701e4ad586f23169fae523c3c4877e6d12a15c4b18c61e62452609ea
SSDEEP 3072:jXdi1Kax5ZsDxojBVapdmii8gaXZx1xW6Uzf3E:jX8ga4xoyFTq3E
TLSH
T106141A686C77F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A9BDF53400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 74b12b33bf387a598ab665e41aabc535df9a338894941d7575c576aee132ae48
MD5 fefb268015c23bec63b1d51154f38a99
SHA1 0209260eb64a62954b57c62c7de8f779bd5726df
SHA512 d77c4ed48982afc5f4ad9cf8000804bc878544412479c92bbe2c262146485c8bed49111611b654bb740f632668f2e4ded94bf6ec282a0409a8dc25d78158dc72
TLSH
T176C09208AF6A0326F14903BF816106426A50A501E1A58B0F04B626689A62F226920EAE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 cb82d4f25cb9f0ec44b305e85fbfc701cca9a85b9e40bef9a7ce57bd7f02606d
MD5 7e46f5e2b4a17a0a083d4a989886d4c9
SHA1 87f45eb719f70eba5f51482e6e76d14c2543904e
SHA512 e36bb20c2be3ea5d51411e491d4d108a635011658e35e3a335ee59302a3951ab710e40e33f7dbb9a01cbf03183b16f1912c46d21b86dbacf2f434dd011f14df1
TLSH
T1FAC02B0C4FAE0325F04503BF41708D022B10D404F28BFF0F0FB22A684565F315810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 e2986cb9f018c1935fbe6f55e236729704232314b419d578f51f24158fde0c85
MD5 68065b5a9ce8cc72c95c1d82afdbe449
SHA1 a4b95ee6e794d70b026db7f25d95bfb01416ca76
SHA512 df28dade05cbd3d5b94b0cbb7ce06f293f690171f38aa6729ae63babaa740aa74a3c3524bbf6be23a3fdadfffe9e04f69c0bbb12d5be7893fcbc2bdced1b2662
TLSH
T169E05E117FE80204F5770B3CA8736545AA77B76BAA51CADD0275008D5C21F61CD32719
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 c6f15205231933c95bcc4b814edf8d38f804f2da89999d488be27acd54d6902d
MD5 8a395baa55e97742f2ebeac2ad05a8b0
SHA1 681518d679d081694d40903c6f3703290815207a
SHA512 87aa97081319a2011762eb511e9f9c2a811af8ea8117c5686a13f431c347ae48d4ca652741ca312deb665fddc598dfebce0729e96ebc4ff8faad5fcfae0c2e59
TLSH
T1D2D08C3C2B5A022EF03EC537C8A541C20EA15903B3A2CF090062460C9CB3F731DA2D2C
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdateondemand32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
Size 105KB
SHA256 74b1373752df8b259e44bc69cd0fce3e268c82c5814acc8155cb1bf36cca60cf
MD5 456c34ff37db338ef6108086f5d17bc2
SHA1 804a513f3b1ea72f1f194a0d7ad0a14a297f5fce
SHA512 f62d79675c77ebac4d125a7bd13da5bc55327d79c65bc338344b503aa9830c7cddd5897377746d81c2336757f8ae9ea265eaec26b92208fb83603c593d1890e9
SSDEEP 3072:zER5AhC48S1m2YPrh4qR8vlZksB+vsdqCWPx5:zEXAe6QPqksB+EYJ
TLSH
T1CEB36D5176D1C8B1E5B6493108E8DDB08A7DFD614E509EAB33D80A3F0F316C1D629ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 104KB
SHA256 0a6b0061c4a5cd0aa1f8510d92edee2015a4f96dece93cd99bb44ea5493178dd
MD5 d2686d0b536412550fd3533778a839ce
SHA1 73eb71ab734cb1377b3d68bbcbafb6a695fbed6a
SHA512 49d90fe90c413af11e87a1048415296b1e7fd7fc0ccfcca1fbac4cc0410d34fb1e16409d750be303a4adc6de95e60eeb77bb60bd1e55933ff21610714ca5afc1
SSDEEP 1536:6Jqwy75UhaasJY9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:ZDwdXphLMZ+tH
TLSH
T156A32A7163F00ABA60C343A47B647A597E95D18BE113C0DCB3BE56516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2236-34-0x0000000002200000-0x000000000224A000-memory.dmp

Download

memory/4228-33-0x0000000002560000-0x00000000025AA000-memory.dmp

Download