14f856fd5a1cd8cb63355d33d023be0c93e5ab62d5710e583643fe657b0dd711

General

Target
2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260516-c3yjpadt6j
SHA256 14f856fd5a1cd8cb63355d33d023be0c93e5ab62d5710e583643fe657b0dd711
MD5 c8bcc095389598c42df7f344d805e67c
SHA1 8b46dcb89af09406590212c4a6ccd08b6720c5e6
SHA512 17a6f1a00bf6ad080da3b40373fef06bb6d73ce17752775e021649b18c68dbeded5bf03396cb1903e14e6dae617b59a9c0c37f202e3f77eb1dd2dcfd5b76c5dd
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEY:GaoVmp+84YAIkOkTB+weaiuWXV
TLSH
T188747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1180	microsoftedgeupdatebroker32.exe
3920	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1812	3920	WerFault.exe	82
3608	2376	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	eventviewer.exe
3920	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1180	2376	2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	81
PID 2376 wrote to memory of 3920	2376	2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_c8bcc095389598c42df7f344d805e67c_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 1556
    3⤵
    - Program crash
    PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1440
  2⤵
  - Program crash
  PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3920 -ip 3920
1⤵
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2376 -ip 2376
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 221KB
SHA256 3f177ebb3c67f5ef2c2aaf245a5c74013e50b0fb7b0c09b95d070d1d946f784a
MD5 2f46fad1935344d2a7dc05cd2a32fee1
SHA1 3642e21d037eb8648158f7f53275ade75a35cddb
SHA512 2bde00887aad0f1e10efd9ea5b87587822bac7e7b6beee25599fdb8a9bac075d0f4b434c3ba9402501e1c8d9aae7957aef2de1397a5ae73a9cacea933adca53a
SSDEEP 3072:PztZXOqHpRENRTlNjX0sjXbM7wlWTHktaksIdF3/S:5ZXrpqXjCYtDHdFvS
TLSH
T17F243B2C6C77F561BDA99E924DA9EA9A23E77DF61621030F0E347F502C03A97CB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 3b7c60e89a485d0629a9cb5f5d37d5a912ff4bcaad502e37d1928ec3a5ec07ac
MD5 99efe1b6bbc1eab0fde89d233351d146
SHA1 9bca08eab67e679a5f9f870dadbc21a0db3f9eaf
SHA512 784d7b406c46d1aacc941d46d3617b49f8bd6651122513a7be4017dca935df40529522c3bc9e493419ff1f451f2939c25fac0872d509c5de20d3af53e484a043
TLSH
T1C7C08C2C1AA60A0AF6A843BC02D139039B209502E2818F0516F12A08CD96B162C78C2A
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 fd9a08b5a494432480dbdeb70838811a9a0415aa4bc2e622911af8fb0652664a
MD5 f9d649a9d606b484e441b65c9544bb2d
SHA1 726847c767d27abdfd40925d803e0d6c97e34336
SHA512 aca57fc7ebf485cb49698bb6efe82d484e7d5579b18bd6b531f0d8ef29a9bc2e8d0b694d441e2a92c0cb3c906f984083d127c41870d954b6821bec82c98edb93
TLSH
T159D0223C2B410336FD27C3380860AF015EA2B113A0688F4C05A6452C5C22B422C11C1C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads