d563651cb502baa4e1d652eb6c1be8c5af50b851686f50a5bb3594e5f45c87d1

General

Target
2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260505-cdtjfaax3m
SHA256 d563651cb502baa4e1d652eb6c1be8c5af50b851686f50a5bb3594e5f45c87d1
MD5 2368f04a1fd1b4c465d6574624b66881
SHA1 4247cb65479d4a7102c579dcdb14dbe0ea748cff
SHA512 365ffc8fc0f0e36f3294f9a92ac62b00c8e6aae236da836138469674839829c01165be2af2aa433ab49040751485f36c49a5039357712e71c684a684b58568d1
SSDEEP 6144:GjuDOhVLS5nj+CUXIYdQMH7cCxP8psB+E9siuW1FXEH:GaoVmp+j4YdQO7cCmWB+E9siuWXW
TLSH
T1AB74AF1136D084B2E1B545310CB6AF748B7EFC701E219A9773A87F6D2E319C0D92A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4676	googleupdatebroker32.exe
4656	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3360	4736	WerFault.exe	84
3056	4656	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	eventviewer.exe
4656	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4676	4736	2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	85
PID 4736 wrote to memory of 4656	4736	2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_2368f04a1fd1b4c465d6574624b66881_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
  "googleupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1316
    3⤵
    - Program crash
    PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1556
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4736 -ip 4736
1⤵
PID:2256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4656 -ip 4656
1⤵
PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 212KB
SHA256 ff37c1e220d467146e5e3cbb77e3acdbae0715c9c8ef051f5e646e277fc4f517
MD5 0231b9254a6e2de776590befdaadea7e
SHA1 9d12139f5ceab19393ba9100209e0ebe5967c21c
SHA512 bddf059f79649836425898f018009652e89c1b92c3c3b90f9681f557d1769d6af5ec2b976106230d7330dc59bc2dd6ed89bde09f9814ac37760b2a1f46057476
SSDEEP 3072:zEi8x5jiuFn28SFxcuKsWiV+mXZo6cTqG0wv/Sls:zP8HFn1SozMAv6q
TLSH
T163242A686C77F061BDA98E924DE9EA9A63E7BDF51621070F4E70BF502C03A97DB57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 bb092551454b89deabf0586947375a3f8b2d14c081e3253edda59de86c232509
MD5 ed3888f7a259a7a0d73243e1cbe83e43
SHA1 9841ac025693033739fdd433983d25ae2f9027ad
SHA512 162e4776d945079e3c26a2b946a0c9d3564e86ec3d7d726154f6bd749b0a06c04ea31c442c4ebdb4a9288e86804445122bef609d44d12c7c3ab4f16eea7544a2
TLSH
T108C02B0C1FDA0335F04803BB017099022A10D408F28BFF0F0FF12A5C09A9F352810DAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 796a91181323bab6ff6d672a4baf1846e5605becb7cf479b90fa03b319f4e7d8
MD5 54132fb1efab53888b25a9375ad1c245
SHA1 c8fd44e8ebf30f6bfae2cd0215d55c6196349053
SHA512 0d4622ba5f2f84c69ec32310dfd8b1de3129e34d99b81d9f3e449f902ff33a67581b772870ba067d805cafdac18eea969322426f117f5054df1fbca5b4cd8253
TLSH
T16FD0A9382BE20332F03BC33995710801AAA03912B4B1CB1E02A244087C60B05296290A
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
Size 105KB
SHA256 d0558fbce5c91fa996f2aabf7aacf687fb873f2666a149af7d50ab4196add67c
MD5 10692357d5f73f6a020f76aba563fd4b
SHA1 87c8b47613a9c2f8b3e4845b5dc2204179750bf4
SHA512 9d06ba5f14e9345afb068e617eeea423f9274f572e12987df58366de71550e10d0e72a45ba4eea58da7fdf2740220fe73314f4a59b68b99ad186c40d4135e263
SSDEEP 3072:pMxJ7Rfp8K172YPrN4vzT+PSZpsB+vs+EOK1xc:pMH7cCxP8psB+E92
TLSH
T11BB36C1276D0C8B1E5B6493108E8DDB09E7DFD614E509EAB33D80A3F0F316C1D625AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4656-16-0x0000000000570000-0x0000000000595000-memory.dmp

Download

memory/4736-15-0x00000000005E0000-0x0000000000605000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads