Overview

overview

7

Static

static

3

2026-05-11...ys.exe

windows10-2004-x64

7

2026-05-11...ys.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    11/05/2026, 10:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_4818d7a80a2129efdaa38fa50a16085f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
  • Size 395KB
  • Sample260511-mbdejsat2m
  • SHA256 a9bf14c364724f848ba4fddf90b409ac5739ccd8d613466971adb4048aec1431
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 10 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_4818d7a80a2129efdaa38fa50a16085f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_4818d7a80a2129efdaa38fa50a16085f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
      "googleupdate32.exe "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3524
    • C:\Windows\SysWOW64\eventviewer.exe
      "C:\Windows\system32\eventviewer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2092
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 1560
        3⤵
        • Program crash
        PID:3708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2092 -ip 2092
    1⤵
      PID:2908

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
          • Size 734B
          • SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Size 4KB
          • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          94C33D778ADC562180302FF1B77EFF1A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
          • Size 215KB
          • SHA256 747da1171fe43f90956a42f6333b1074dd3783a2391ed66ff4b8614ce15b63fc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          103621DE9CD5414CC2538780B4B75751
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
          • Size 192B
          • SHA256 0424d3ed0c1c0603799a0c14e6b4b000105690c133d511cccd945b36f32aefc9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
          • Size 342B
          • SHA256 18d5034a4b89b5101fab3d65b02bff7abc215824d1dac343814dcdd4fa70754b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          94C33D778ADC562180302FF1B77EFF1A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
          • Size 246B
          • SHA256 70ba9154ffa9d0e9b0a68d3cd2004efcb61578d3018b4697f1dc497b949eff90
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          94C33D778ADC562180302FF1B77EFF1A
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
          • Size 246B
          • SHA256 2f32f649ba13c4f2d23582c9be49e6e056ba8019cfc105b19ef9c28ddd1bdaa1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          googleupdate32.exe
          • Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
          • Size 158KB
          • SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Temporarily
          • Path C:\Windows\SysWOW64\Temporarily
          • Size 107KB
          • SHA256 8fc315d9ef2b51c1101925e122f8dfe3522eaca5449773e8762c1b82d04b3f22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          eventviewer.exe
          • Path C:\Windows\SysWOW64\eventviewer.exe
          • Size 88KB
          • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download