058b87b031ada3cde8bae20880270f32a4d64128c9c02adbcca9df8891352d63

Analysis

max time kernel
148s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260525-cl1bysav4l
SHA256 058b87b031ada3cde8bae20880270f32a4d64128c9c02adbcca9df8891352d63
MD5 7b83bb6e92d3c85b29331fc8131c382e
SHA1 4fc817044f1d069b40f3e3b1b38d8a9c087fbbb3
SHA512 30dd4f6b606988904a6a4e48c27ce5f072701ed677415c96ec9ca6de1d089e34034d908d5e1bc54fdda0d5274116fb89eeab3480c91e8f016305c2c5f41e299e
SSDEEP 6144:GjuDOhVL4RnCaXIYl0540UVwleMITTmNv1ohWsqkiuW1FXEM:GaoV0b4Yle4lssmroCkiuWXx
TLSH
T10AA47C2535E400F2D1B6C1B58EE08E66E375FC7517208EAF4390A75A5E33A905D3BF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
900	microsoftedgeupdatecomregistershell6432.exe
4548	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4232	2632	WerFault.exe	78
3952	4548	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	eventviewer.exe
4548	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 900	2632	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	79
PID 2632 wrote to memory of 4548	2632	2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7b83bb6e92d3c85b29331fc8131c382e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1472
    3⤵
    - Program crash
    PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 1888
  2⤵
  - Program crash
  PID:4232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2632 -ip 2632
1⤵
PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 4548 -ip 4548
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 222KB
SHA256 4a474d093c1e3ce91707ff90da6c5d899b9471ac172cf8e4ba4d57b888d0211f
MD5 ba28f41632ce1d7176f97c31513a1ee4
SHA1 4c33264229344c253343c9980d8688568c5b751b
SHA512 f112f4705ca4ba7d3e5d91a6bc15887d83d51b2a0b5a574ad52cd82cd4faa8a895b2ec702b4a499dadce73fbda6eeaff408e8c2567bc5139e71f8c04f6659101
SSDEEP 3072:VtZlOqHpRG6e1Qv1XWtaX5Baw2mTeDtb87I7mSLaT:nZlrpAY1natYE7mYY
TLSH
T19E242A2C6C77F561BDA98E524DE9EA9663E7BDF61621030F0E347E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b107fb198aa9c987e9c5bc29b99ea61d69f48b68d4291377082e8537fd209786
MD5 d21dc7ba5cf1c04e834708cef159098d
SHA1 d7377eeaf8757a9ecf99b55a5733c3a21ebf575c
SHA512 f69785d4dbff4a3db58d071723376daea4c38898cd74f70dd2084b2f43946c3aa70247e8df7bdbe6431394b0791688be935b2798baab8da7f07cefd6ff81ce94
TLSH
T187C0801C19610505F294437C41C1390357614101F682CF0516F16504C952B152834C29
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 e363535ca0b8ec6819991e7280bc5e54db8193d8010505e4021cddf9a16fb742
MD5 47bbdef58c6f3545225401192bc56eec
SHA1 e054d85d4a2e98f3638a51598f8a187d4a93e907
SHA512 3b2087b8c274a62dde6f04567c65d2a08fdca0edd19d1871ab0febcf7dd6b17083dd10c949d1d823b81339d260d7d8f1df522cf5a1585ea34e6f810a435bd766
TLSH
T1D8E05E112BE80214F6770A3CA87366459E77B76B6A51CADD0275008D1C22F61D932729
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 51689baf372917db502f2ae8c3b10be8aab8078c2c39ebe6000d1c133d12ffd1
MD5 dc32362dd372b2d43f037d813ff182fa
SHA1 a4d5158f19516e2bea491114da719714d2bcb5d3
SHA512 1fa7e71985e47a2e257c5161026c17685bd25d57f69cab744a5e4cd38017244e65745e0102a8e7c157125eec4bf2e6470fced09b48ba83aa2cff0d8fbc1de4ec
TLSH
T120D0C7381B55031AE565C97595310A4159A0355369A1CF490E72888C9C21E5519B0E0C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 65647b0a22d1f2466baadce6b2ca2d8be62f2d31d8a547d06b93ceb0d96e6bba
MD5 251e1e8d9d08eefa1311399e78e9eaf7
SHA1 6e5ecb3793bc45d8247e06fe6f9c93cd53544b79
SHA512 e9e691ad3a627d830a369a4ab622a639e32667369e9f0ffd9a323d2354611efd2038884427bc9cd5afcc6afd8fd498d5aa2105d1a43cae224ea37d56256c6220
SSDEEP 1536:EJAyOaasJD0ILFOQpbHtphwSHPPnOED4LZFasOtN9WlQIz:MO6XpxvMZ+tIz
TLSH
T1EAB32B7163F00ABA60C343A47B6476697E55D18BE113C1ECB3BE16516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download