302a1a394155e47adf7ba5706c5c5d92ba3b9b9f33cc360754dddc4b20af2734

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample260522-cf36nact6q
SHA256 302a1a394155e47adf7ba5706c5c5d92ba3b9b9f33cc360754dddc4b20af2734
MD5 0f5d202ade424b79073e0d8b9a7461e8
SHA1 adba3dd5a46f865c2af8f79d19060bc48a8094a5
SHA512 40ebbd24be297db210bade9398fdab6837479923bb42cd1e45463dd49ed85c262dddd6ecfce05b9a220cb3b4eab8b8566c44cab9a8078267d7a7de24ebdd70cd
SSDEEP 6144:GjuDOhVLS5nj+CPXIYKAel/DRfkTC3dM7B+mCiziuW1FXEl:GaoVmp+84YKAelbRfky6B+mCciuWXU
TLSH
T17094E31237F84A68F4BB5A305C759F399A3BBC309E30E7AE16502A5D3D31A419D21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3688	microsoftedgeupdate32.exe
1516	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4100	1516	WerFault.exe	82
3756	3628	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	eventviewer.exe
1516	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3688	3628	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	81
PID 3628 wrote to memory of 1516	3628	2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_0f5d202ade424b79073e0d8b9a7461e8_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3688
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1468
    3⤵
    - Program crash
    PID:4100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 1908
  2⤵
  - Program crash
  PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1516 -ip 1516
1⤵
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3628 -ip 3628
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 221KB
SHA256 b30fdb4f31827a037f56039086f1d5b9960d2a04a1809111fb91efb4c56715a5
MD5 e3f52626f09dcf17ccf8edf53d8dcafd
SHA1 e8ab75adfe914207d00099cd2f56a103fe19492d
SHA512 510f3777396244e9bd66577094d69ccfca745cd0ea19b893a380c4d0e6dd9123b5ea88f88e5c83300def11c72e7830f1f6e26d75fd57454452eb4d1101b6b280
SSDEEP 3072:tztZXOqHpRE6R+ixmXFsGXac7wv8THItVJsIWui/o:rZXrpYkmp8t7HWu2o
TLSH
T11D242B2C6C77F561BDA99E924DE9EA9A23E77DF61621030F0E347E502C03A67CB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 e21d8a735b8f738910f5ae0780874ee22299a842805534377355c0ac649c0031
MD5 5daf59bf8419c0117527c7b6a3d52afa
SHA1 c55580213ffb0b4409ee3d1dd5b97eff59b2a8ba
SHA512 c0c3f76f6e314fb9c3041fd8b72194fbc511ec8a61b32abf79bc815bf902f9ecb2d10b02de174fde722c1d2af7d345ec483a638253e627d1661018272d60a40c
TLSH
T167C022082A820228F28C833C22A032828B808200E0C08F0A00FA0A08A223A083820CBA
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 0c471482051cdefd3ff2bef5d3a9c8d155cb75e56a587cca044d074abf1a964d
MD5 336eadc3b30f4b463f85f06bf1117ca0
SHA1 f9d2a14e1dc05a20e91b14080e366e734b8c35f3
SHA512 745369e77f9fee7908c5a369fb90d9b127be2040eeba7458661f7681f977e71ffe01ab2d7ec260afefaa6c7ec45f00dd9bf2c84fffcd954b48fc43693c7f6f62
TLSH
T1FBE05E112BE80205F6770A3CA87365459A77B76BAA51CADD0279008D1C25F62D933729
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 580392390ff6d744c55d3b3066a684f62d9bbd29d2027dbbfccb998735c04ba7
MD5 37dfb3d0ce8a14b8a10b29329aa18a32
SHA1 0dc964c2c7757a0d7ad9b7369a35fcdc2292c945
SHA512 cbf40c65ee830d83672abd70671ff051d0284f4a31f04a7c56e9878ac3e06f10e805f87626d3f8b1d27512159b4f1dd473f469b7f155548c4dd964ebd1a6279f
TLSH
T187D08C282FA5123AF024D239A9B601854CA1A623A0E0DB0E20BD4A4D5CA3F139C32F0D
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 74cc3d42a00c6229266bce5f06a1970bdafe39b4d436a4873c7d45a78aee33f6
MD5 abec0de697acf6eab31f85bc882aae80
SHA1 9b22d7f447004eba406c6316276e97c304a88537
SHA512 167af775527a957cd19c47867d19d30d74ef05a59862426a41d6fe5b944964eda2718950b54a8d48aad6ec8d654846f067dda4156a8cda2e63eb176dc715e3c3
SSDEEP 1536:6Jqwy75UhaasJD0pLFOQpbHtphwSHPPnOED4LZFasOtN9WlQIS:ZDw1XpxvMZ+tIS
TLSH
T14CB32A7163F00ABA60C343A47B647A597E55D18BE113C1ECB3BE52516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download