Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
- Size 335KB
- Sample260518-b2ppqaay5n
- SHA256 af23f0b77cd6180302e9cd5aa1fb65030d2e64325629f0ed3cc623b132a06fdd
- MD5 7fe04ccb47988e8f311cab5511921a94
- SHA1 b0fa98c8cbcbd7aebe12df91109ad0c1ebda2ceb
- SHA512 e86060d553dc01077553efa66d8348549ed40cf40be478024948627b88d6fb210137092906e40dde951f4a0968a7deda683a94e051f703c15ab99f29b3b86bc9
- SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEu:GaoVmp+84YAIkOkTB+weaiuWXr
- TLSH T188747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1092 microsoftedgeupdatebroker32.exe 2272 eventviewer.exe - Loads dropped DLL 8 IoCs
pid Process 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jstatd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\tnameserv.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\7-zip\7z.exe eventviewer.exe File created C:\program files\common files\microsoft shared\source engine\ose.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\rmid.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jinfo.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\mip.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\appletviewer.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jsadebugd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\internet explorer\iediagcmd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\java-rmi.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jsadebugd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\iecontentservice.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jabswitch.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\keytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\officec2rclient.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\keytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jp2launcher.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\klist.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javafxpackager.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\orbd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\elevation_service.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\java-rmi.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\elevated_tracing_service.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jhat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\klist.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\iecontentservice.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\os_update_handler.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe 2272 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2552 wrote to memory of 1092 2552 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 87 PID 2552 wrote to memory of 2272 2552 2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_7fe04ccb47988e8f311cab5511921a94_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe"microsoftedgeupdatebroker32.exe "2⤵
- Executes dropped EXE
PID:1092
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2272
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
- Size 98KB
- SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
- MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
- SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
- SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
- SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
- TLSH T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH