302a1a394155e47adf7ba5706c5c5d92ba3b9b9f33cc360754dddc4b20af2734

General

Target
2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample260522-cf36nact6q
SHA256 302a1a394155e47adf7ba5706c5c5d92ba3b9b9f33cc360754dddc4b20af2734
MD5 0f5d202ade424b79073e0d8b9a7461e8
SHA1 adba3dd5a46f865c2af8f79d19060bc48a8094a5
SHA512 40ebbd24be297db210bade9398fdab6837479923bb42cd1e45463dd49ed85c262dddd6ecfce05b9a220cb3b4eab8b8566c44cab9a8078267d7a7de24ebdd70cd
SSDEEP 6144:GjuDOhVLS5nj+CPXIYKAel/DRfkTC3dM7B+mCiziuW1FXEl:GaoVmp+84YKAelbRfky6B+mCciuWXU
TLSH
T17094E31237F84A68F4BB5A305C759F399A3BBC309E30E7AE16502A5D3D31A419D21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	microsoftedgeupdate32.exe
2664	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2828	2664	WerFault.exe	89
2120	4800	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	eventviewer.exe
2664	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 1920	4800	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88
PID 4800 wrote to memory of 2664	4800	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1920
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 1328
    3⤵
    - Program crash
    PID:2828
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1320
  2⤵
  - Program crash
  PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2664 -ip 2664
1⤵
PID:1908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4800 -ip 4800
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 221KB
SHA256 b30fdb4f31827a037f56039086f1d5b9960d2a04a1809111fb91efb4c56715a5
MD5 e3f52626f09dcf17ccf8edf53d8dcafd
SHA1 e8ab75adfe914207d00099cd2f56a103fe19492d
SHA512 510f3777396244e9bd66577094d69ccfca745cd0ea19b893a380c4d0e6dd9123b5ea88f88e5c83300def11c72e7830f1f6e26d75fd57454452eb4d1101b6b280
SSDEEP 3072:tztZXOqHpRE6R+ixmXFsGXac7wv8THItVJsIWui/o:rZXrpYkmp8t7HWu2o
TLSH
T11D242B2C6C77F561BDA99E924DE9EA9A23E77DF61621030F0E347E502C03A67CB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8a43d360d728b0e3eb2ef90e3398d25ef006c901179f3af2a7d1478201b40f1a
MD5 d87e8eca36d061b1a0f78ddc4d0ba1c7
SHA1 041b682ec5cebe0e186d00ac589623c134fd33ca
SHA512 66aa99f3b179b79d7ccc4150576d683813c4e2480c24e1e017e5bb3c87796408332e0f1631226940b79d7668058a5a867ef8e34401dfbbb2716778ba54d34ebc
TLSH
T1E1C08C1C1AA20A0AF2A8837D02C239439B208111E2818F051AF52A48E992F1A6838CBE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 3ed0ab51a2f1e70bd46f3b04301abe7c15295077470ff22bcff6d4ec03ea0254
MD5 cdb2e4e104f337a295c7a2bc9a870b5c
SHA1 84e1a4a358e6917e5c2ecacc6fa27d55c62e2197
SHA512 9093129c2e616cd9d7d6f7f330c140261c7de955d509d28c8cc2670fa999792f6b2529b423ce1085fb40224f1915c9c01ba7db8ddcb168435533816247825754
TLSH
T109D022A85B982233F010DA31E4B401419DB6A523A0E28B1A20B9464D5C63F136C71F2C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads