Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/05/2026, 02:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
- Size 335KB
- Sample260516-c3yjpadt6j
- SHA256 14f856fd5a1cd8cb63355d33d023be0c93e5ab62d5710e583643fe657b0dd711
- MD5 c8bcc095389598c42df7f344d805e67c
- SHA1 8b46dcb89af09406590212c4a6ccd08b6720c5e6
- SHA512 17a6f1a00bf6ad080da3b40373fef06bb6d73ce17752775e021649b18c68dbeded5bf03396cb1903e14e6dae617b59a9c0c37f202e3f77eb1dd2dcfd5b76c5dd
- SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEY:GaoVmp+84YAIkOkTB+weaiuWXV
- TLSH T188747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4768 microsoftedgeupdatebroker32.exe 4580 eventviewer.exe - Loads dropped DLL 12 IoCs
pid Process 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\java\jre-1.8\bin\java.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\scanpst.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\installer\setup.exe eventviewer.exe File opened for modification C:\program files\internet explorer\iexplore.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\policytool.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jjs.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msoia.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msouc.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\perfboost.exe eventviewer.exe File created C:\program files\7-zip\uninstall.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\shapecollector.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jstat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msqry32.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\klist.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\skypesrv\skypeserver.exe eventviewer.exe File created C:\program files\google\chrome\application\chrome.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javadoc.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\unpack200.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jarsigner.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\cnfnot32.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\perfboost.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\chrome_pwa_launcher.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\elevated_tracing_service.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\idlj.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\rmiregistry.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\orbd.exe eventviewer.exe File created C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excel.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\protocolhandler.exe eventviewer.exe File created C:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\chrome.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jhat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jstat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\os_update_handler.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe 4580 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4676 wrote to memory of 4768 4676 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 84 PID 4676 wrote to memory of 4580 4676 2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe"microsoftedgeupdatebroker32.exe "2⤵
- Executes dropped EXE
PID:4768
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
- Size 98KB
- SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
- MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
- SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
- SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
- SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
- TLSH T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp1FA4.tmp
- Size 152KB
- SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
- MD5 dd5645a32ccec6b1fd23a936699bc3d4
- SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
- SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
- TLSH T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp1FA4.tmp
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH