058b87b031ada3cde8bae20880270f32a4d64128c9c02adbcca9df8891352d63

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260525-cl1bysav4l
SHA256 058b87b031ada3cde8bae20880270f32a4d64128c9c02adbcca9df8891352d63
MD5 7b83bb6e92d3c85b29331fc8131c382e
SHA1 4fc817044f1d069b40f3e3b1b38d8a9c087fbbb3
SHA512 30dd4f6b606988904a6a4e48c27ce5f072701ed677415c96ec9ca6de1d089e34034d908d5e1bc54fdda0d5274116fb89eeab3480c91e8f016305c2c5f41e299e
SSDEEP 6144:GjuDOhVL4RnCaXIYl0540UVwleMITTmNv1ohWsqkiuW1FXEM:GaoV0b4Yle4lssmroCkiuWXx
TLSH
T10AA47C2535E400F2D1B6C1B58EE08E66E375FC7517208EAF4390A75A5E33A905D3BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1096	microsoftedgeupdatecomregistershell6432.exe
5112	eventviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe
5112	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 1096	924	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	87
PID 924 wrote to memory of 5112	924	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 222KB
SHA256 4a474d093c1e3ce91707ff90da6c5d899b9471ac172cf8e4ba4d57b888d0211f
MD5 ba28f41632ce1d7176f97c31513a1ee4
SHA1 4c33264229344c253343c9980d8688568c5b751b
SHA512 f112f4705ca4ba7d3e5d91a6bc15887d83d51b2a0b5a574ad52cd82cd4faa8a895b2ec702b4a499dadce73fbda6eeaff408e8c2567bc5139e71f8c04f6659101
SSDEEP 3072:VtZlOqHpRG6e1Qv1XWtaX5Baw2mTeDtb87I7mSLaT:nZlrpAY1natYE7mYY
TLSH
T19E242A2C6C77F561BDA98E524DE9EA9663E7BDF61621030F0E347E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 62efd3cb571f39c96ae40052de01376d0c4bfe8aa1fe685916d94b853c1541d3
MD5 6f6adf2c7ea9dd025875123e13589d1d
SHA1 15160be6b4cc549fad6e306fa87b7c4dffd1b647
SHA512 c1fcb1c5cdb3ade72a3bd94b4b3a87e190388f93a60e45bb9b5c2df000286e967f87cc2e27796bf83d14e745915fd5dd0e748ffaba6e104620e85960994ed23f
TLSH
T1ACC0801C1B610505F294437C41C139035B104502E2418F0516F13504C956F152934C69
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 9e3fdfa0f5f42331a4e2494cf2ce774ef494af5e76b9eee9ad0900d38ee02ac8
MD5 3f98d6698cb378fcd347c121763a2dea
SHA1 54330687724cf2c093617440c551908596c18b41
SHA512 e90cbf69dbeb7bb92a3e423a4b65c41413a71ce837bc48e98a44c8f596566fcca6193525b1b1d99adb4cd7f71a8885c40630fd010050ea2c0d9483a5bc489163
TLSH
T183D0802C1F551327F179C936983003414DD4365264D0CF4D0CB1444C5C32E811C60E0C
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
SHA256 058b87b031ada3cde8bae20880270f32a4d64128c9c02adbcca9df8891352d63
MD5 7b83bb6e92d3c85b29331fc8131c382e
SHA1 4fc817044f1d069b40f3e3b1b38d8a9c087fbbb3
SHA512 30dd4f6b606988904a6a4e48c27ce5f072701ed677415c96ec9ca6de1d089e34034d908d5e1bc54fdda0d5274116fb89eeab3480c91e8f016305c2c5f41e299e
SSDEEP 6144:GjuDOhVL4RnCaXIYl0540UVwleMITTmNv1ohWsqkiuW1FXEM:GaoV0b4Yle4lssmroCkiuWXx
TLSH
T10AA47C2535E400F2D1B6C1B58EE08E66E375FC7517208EAF4390A75A5E33A905D3BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp18F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp18F1.tmp
Size 152KB
SHA256 ddf4b5ab3491bb76333a03d97cb478fe7c1c2cb05f20e3b33d361c14a56a2050
MD5 f58985ef7e229dc39a3f39f72be34a2e
SHA1 7cb15b35b1e2a75de791f025df438461c1697599
SHA512 e4144ea0e9a406dcdb893d67f3f79ec64a86e7f1553ff288adea48948ade05f080c50884f36f0785aaec19ca6764d794e576196ea03082c653f384cc05c6a6df
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAM9RnCUjX5XIYbMQp:ujuDOhVLAyRnCaXIYbR
TLSH
T1A6E3AE2172C1C4B6E1BA41328D758F745BBAFC795EB2460F63A43B0C1D726910D2ABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 43639033d9ff5b9b9a90321c1d516460bc520a94414ab9af8a9debb2ed570cf9
MD5 1460f5c64c838744288e1288df25b66b
SHA1 4cd089167f14713ec57ae2106926cbbe48fbc8ca
SHA512 5001d859bee4af3317ca88ba9de89d98c4a74bbc1b3a314b4941e6f1e49e0722f9c8bc6d1f61a494a872c0584f52ac844c8d784c70f211e5d4869e7052279828
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja69RnCUjX5XIYlMQB:GjuDOhVL4RnCaXIYlJ
TLSH
T125E39E2172D0C4B6E1BB41328C759E749BB6FC784EB2860F23A47B0D1D726914D2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download