f7f2a14f6290e5a1c884cb80ff8957f3f4514326c0d6699c05585567169cfbbb

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260506-cd4dmsht9y
SHA256 f7f2a14f6290e5a1c884cb80ff8957f3f4514326c0d6699c05585567169cfbbb
MD5 45737787cb0ed19ba3b0079d4a658e53
SHA1 142ac175d23f1d06f2a791383aced380e8cb4d8e
SHA512 e4cabe7114c6df6e419f004f822b7d1203168a72d0d85436a2961834c2ccfa371f9b29116d2c02b60592be673b897e0b97b993cb6fe689b0b6e43db9e663f93c
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEO:GaoVmp+84Yb4lssmroCkiuWXf
TLSH
T135A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1968	microsoftedgeupdatecomregistershell6432.exe
3848	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2796	1036	WerFault.exe	79
2272	3848	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3848	eventviewer.exe
3848	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 1968	1036	2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	80
PID 1036 wrote to memory of 3848	1036	2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_45737787cb0ed19ba3b0079d4a658e53_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 1972
    3⤵
    - Program crash
    PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 1704
  2⤵
  - Program crash
  PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1036 -ip 1036
1⤵
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3848 -ip 3848
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 213KB
SHA256 2182e2d610be8d616bb7eb0e0faf5c21094e7b0113c37bfe9f3dbe0a46694154
MD5 70501ed947f21212fa1bd9291a5473df
SHA1 458855404fb2fc7014ec4947b7a435f0572c49f9
SHA512 ba55f96dd5f75cb107afb185de75bd08e058d8ab7c42d4c9f904d11128fdfd5b1311926a2b000c55798da7ff5119c149338aecb6b66b232f167cb7f82551841b
SSDEEP 3072:u8b5jiuFT9mSuxcuJq4iQ+mXZ768VqCgwHF4c9:u8RFTUSMLeaHSc9
TLSH
T1D7242A686C77F061BDA98E924DE9EA9A63E7BDF51621070F4E70BF502C03A97DB57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 cc7289cf79f836e1b169c2d41e13df210977cf4f0a660fc866db36c2a63a9c72
MD5 1983f386364431170a7da19d8fd661ea
SHA1 940ccec3732e3e86b435ce96cf431637f800fdde
SHA512 cfa04db11a830ce6a91fef36af2a7a85ed6d5a1f79a116eb8148f74d40c897274bbc895cdfee1525a366e299276d9d01c5938c5091b125f9e644ba26af10b77d
TLSH
T1DBC08C0C0F9A0625E08803BA422089025A10D405E28BFF0E0EB12A68056AF615810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 4f148c0b189b8c6687572fc08d5e8792940221e6597353abbed67916e8c34d4a
MD5 7a61c9d45528f7cbcbbaabb4b00d2345
SHA1 4af81d53db8be1f2445c28316f259c83fd1b4499
SHA512 98793d8e448e795195cd6404755f412c37ec780cbd67314d518c858f0a1ba286158b3a5dddd4a7e7dc621d1e55a6e9f447e75bf2a2f98d2165dd93c98318e95d
TLSH
T174D0223C2F540A3AF8BCC23909E0C6004A9123229072430220F1A90FAC387002F24C0C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1036-10-0x0000000002480000-0x00000000024E4000-memory.dmp

Download

memory/1968-9-0x000001A4F30A0000-0x000001A4F318A000-memory.dmp

Download

memory/3848-11-0x0000000000890000-0x000000000094B000-memory.dmp

Download

memory/3848-15-0x0000000000890000-0x000000000094B000-memory.dmp

Download