Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
- Size 418KB
- Sample260523-e2kmjsfw3y
- SHA256 292e772e92ab2f768b88819105c0aebf73aec2b69fb3b6cbdc464cf8bffda6c1
- MD5 fc7d65f8c4002bbf5cf2d56652a6cc13
- SHA1 bf2dee4d944ad26ca3cee9485ef1b6f9ceeeeb40
- SHA512 a014fb0f5f31bc546d0a3e4751f0788c366985b33ddc5635cb6469e69a29caa5ea7463d7445ddee29803860475572b10a9ea840e45ff1a8a7a6abe283cb14329
- SSDEEP 12288:GaoVmp+84YWi3drBRy9hdFIdhoyYTiuWX3:GDVmpzSi/RyhdshPmiuWX3
- TLSH T1D0947C1632D44EF5E1AF403088615A75E773BC200F219BEF43A4AF69BE326909D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4724 googleupdatecomregistershell6432.exe 2128 eventviewer.exe - Loads dropped DLL 12 IoCs
pid Process 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\idlj.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javac.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jrunscript.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\sdxhelperbgt.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\elevation_service.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jstatd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\policytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\orbd.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msohtmed.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\pptico.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jarsigner.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\rmiregistry.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\tnameserv.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\notification_helper.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excelcnv.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msotd.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msouc.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\powerpnt.exe eventviewer.exe File created C:\program files\7-zip\7z.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\extcheck.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jar.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\rmid.exe eventviewer.exe File created C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msoev.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\scanpst.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\sdxhelper.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javadoc.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jstatd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msoasb.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jstat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\onenotem.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\winword.exe eventviewer.exe File created C:\program files\google\chrome\application\chrome_proxy.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\appletviewer.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javafxpackager.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\ssvagent.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe 2128 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1780 wrote to memory of 4724 1780 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe 88 PID 1780 wrote to memory of 2128 1780 2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_fc7d65f8c4002bbf5cf2d56652a6cc13_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe"googleupdatecomregistershell6432.exe "2⤵
- Executes dropped EXE
PID:4724
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
- Size 181KB
- SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
- MD5 c2c0992a4565b32faf92cb0b21765ca8
- SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
- SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
- SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
- TLSH T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp2BF8.tmp
- Size 152KB
- SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
- MD5 dd5645a32ccec6b1fd23a936699bc3d4
- SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
- SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
- TLSH T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH