145c34c9715b01bfc0748905313f06bf2b18b6a03c621bdcdca839656586a69b

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260525-cc6glsat3n
SHA256 145c34c9715b01bfc0748905313f06bf2b18b6a03c621bdcdca839656586a69b
MD5 40c5c32ec08090b49e0b2e6969549e13
SHA1 9eee15d3b5ad2713a99e6215f27722a2c80fb47a
SHA512 9f4787d3bea90459051acd657c9a8bf78cfebd62b68c907d5cf3369a3fef30d718f8ff707cd8049764a210f13125a5c13004510ffd9fe4ebe9ad062f9e37c25c
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEk:GaoVmp+84YAIkOkTB+weaiuWXp
TLSH
T139747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2172	microsoftedgeupdatebroker32.exe
3756	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2984	3756	WerFault.exe	85
2684	4368	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3756	eventviewer.exe
3756	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2172	4368	2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	84
PID 4368 wrote to memory of 3756	4368	2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_40c5c32ec08090b49e0b2e6969549e13_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3756
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1308
    3⤵
    - Program crash
    PID:2984
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 1560
  2⤵
  - Program crash
  PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3756 -ip 3756
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4368 -ip 4368
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 222KB
SHA256 87c757f97ea1d9a3eb86dba6ca510ae13d25535beccd052aad06dc4f085e7b22
MD5 566c6294ed181510079d070154ed1955
SHA1 b080a15cd0b2695af42542daf8caf8e1be0b9f7d
SHA512 7a121ecfadd263d91d714679e72797876a48a58b8e020a4fc6bd641006f5efd40e6497065e1bee434047346c6779e926835136b7ef0c4fa064f089d521e39ceb
SSDEEP 3072:WtZlOqHpRG6e1Qv1XWtaX5Baw2mTeDtb87I7mSLa5:gZlrpAY1natYE7mYa
TLSH
T1FD242A2C6C77F561BDA98E524DE9EA9663E7BDF61621030F0E347E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 382d1a3a069d223f7f983902bef167543f2c6fb93fee8a713d9cc76090df8e26
MD5 f13bba3deef7f2d04db26250d390b131
SHA1 b0564e35865ae14cd5b48df009c6a4105bca7684
SHA512 da0a8b8608fae119a5ef909666bdb794f89b86ebc45c3d6e3c30c5acbe4d4251b235be6c11f28a24632f9eb43174cbe174fcf8827cba0ae6089a1856eeac115a
TLSH
T14EC02208AFA20328F2C8033C8280B2028B808200E0828F0A00F20A0882A3E083830CBA
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 bdaf4db974919ae2930e3ebcb21d013879ff6b30c5012da10e2a7bd09215bba5
MD5 0143c7433337a0a87a2d5da3d8a2f15c
SHA1 4e6dd47a1cbf2b267d3e7fa986e94f2460c227bc
SHA512 d02d96bee1217591c8c7ccdddfbbf017b6881764ae3acba26a8690d1b1dc467b87cb6710544197d99f5e3d442b4be600d1c149ae68a07c3b36b80c6979e25c2d
TLSH
T166E02E016BE80208F6730A3CA8336208AE37B73B6A01CBCD0235008E0C21F62CC3271D
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 f7174bc4f7e91bef27f5a604917b9c30d8bfee8641e8e42939f54833ac92c678
MD5 8215787e8fabe063da5091b05ea9a4e3
SHA1 84e987b1e8604afecaab9fd06a49ed0f15b69234
SHA512 ed107dd5ed352727f9abfbd5e41d3af47ec247ab88b18d776d43bab75eb713843135caf9de4887b390bdcc2997c454018cee799e3a1f2285ad1e6819c09eec26
TLSH
T114D012155FA5023EE5AAC33594F15B03FE752165A6B1C3890B7B4A2E7C7AF200D61D0C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 b153da8be00f7ff65be7baf7dcc5812f3d10bceee47c1c98fa537df06d43c21f
MD5 a5e5f1a09dc2af29af84fc3aecbbe068
SHA1 d974724704922316d10dace6a352a8d3ffc08e9e
SHA512 289aa2ec733a9150809c9ab41497d49c9cecbc3ab8f8546d2ddef6d8c6a80b29aef5bc2e289ee7d3d0ccdf103bd2f9eacbdd8112a251f2082d1e21154b1afb46
SSDEEP 1536:YPJAyOaasJD0ILFOQpbHtphwSHPPnOED4LZFasOtN9WlQIS:Y9O6XpxvMZ+tIS
TLSH
T156B32B7163F00ABA60C343A47B647A597E55D18BE113C1ECB3BE16516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download