d76fb9a44bdf217e3ce72b8b6d26fbba2c41a3688c433a2e9495ce415116c599

General

Target
2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260522-dca65sfy5s
SHA256 d76fb9a44bdf217e3ce72b8b6d26fbba2c41a3688c433a2e9495ce415116c599
MD5 69af4820f607a9bcb31b7ebf18deabbf
SHA1 1dbc99f488d91868ed012a656c7ddc88d50544eb
SHA512 730ce9173308342487ab1981b9cd6c0387cdf8b4daa67f4e2932e1c457e498e5d7150975cce88c1250d67bf0ed8e044b22364d42b9e877ba4f0ac2463b1983ec
SSDEEP 6144:GjuDOhVLS5nj+CPXIYmMH7cCxP8psB+E9siuW1FXE2:GaoVmp+84YmO7cCmWB+E9siuWXL
TLSH
T1BC747C1136D08FB1E1AF443148A59E748B7BFC304E219BDB63947E2D3E31981DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2916	googleupdatebroker32.exe
1652	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4268	1652	WerFault.exe	89
3276	1092	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	eventviewer.exe
1652	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 2916	1092	2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	88
PID 1092 wrote to memory of 1652	1092	2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_69af4820f607a9bcb31b7ebf18deabbf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
  "googleupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 1328
    3⤵
    - Program crash
    PID:4268
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1192
  2⤵
  - Program crash
  PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1652 -ip 1652
1⤵
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1092 -ip 1092
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 221KB
SHA256 65f4040e41a1827da26d6235fc11980d3e5f6e29b91773ca0cb86d43c4c2616a
MD5 082456a0771cbac8b96d1d884b2b260e
SHA1 15821a26d6510f14a382820c759448110252980a
SHA512 5f847c28350346e406a7217567d0e9c4117cc4cc68c93a8f37d36cc9b334d31d4c225949e5ef0a770882d68dc6ce74ca13d94aa706aaef58e498ceb5e9de84b1
SSDEEP 3072:fztZXOqHpRE6e+ixmXFsGXac7wv8THItVJsIWuq/Q:pZXrpzkmp8t7HWueQ
TLSH
T119242B2C6C77F561BDA99E924DE9EA9A23E77DF61621030F0E347E502C03A67CB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 0ce59b128d703385a5da89f3a2a0570cf11bd90badcdf1f49ea4af7bb825786f
MD5 f6824a40c225ae286a03606568fb6012
SHA1 1709064942fd96e02a340e18c3eed9e85f2d3949
SHA512 c7007ffa63ce382d608c276741ed1d61569c9d4e1b1b259066f58884adfda326a71ffb56637b5f51ab3c99eecc782b13006e68bce9587789415693582e51a7ff
TLSH
T1A4C08C1C1AA60A06F2A8837C02D13903AB208502E7818F0526F62A48C992B266C38C3A
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 51c6e63ffb7a51e760ccc03abb60a7bdf9e983beab86096c52b944b5e6cfd213
MD5 c97124ec8ffcd45b15fd0811446cc33e
SHA1 e40b7c72f55c65ffaa90f4c514c80b032b2544c2
SHA512 b60a88c9bc1807408137d1adcd9b2c948899e9c56e794634b2ab8e79f8b4a057ef74ca49136fc34efea2ea9914a502c033e8ad1b2efa060fcf74160a8114b3d3
TLSH
T17DD0223C0B311622F0A5C23AD8A84583AEA004107060AB7C35F2930DFC23F476D13C38
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
Size 105KB
SHA256 d0558fbce5c91fa996f2aabf7aacf687fb873f2666a149af7d50ab4196add67c
MD5 10692357d5f73f6a020f76aba563fd4b
SHA1 87c8b47613a9c2f8b3e4845b5dc2204179750bf4
SHA512 9d06ba5f14e9345afb068e617eeea423f9274f572e12987df58366de71550e10d0e72a45ba4eea58da7fdf2740220fe73314f4a59b68b99ad186c40d4135e263
SSDEEP 3072:pMxJ7Rfp8K172YPrN4vzT+PSZpsB+vs+EOK1xc:pMH7cCxP8psB+E92
TLSH
T11BB36C1276D0C8B1E5B6493108E8DDB09E7DFD614E509EAB33D80A3F0F316C1D625AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads