438af10e4a873de99d9ee9e1c93bff45b4c97788eda537120ec54f0a9ad26fa6

General

Target
2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 570KB
Sample260528-dd39baes7l
SHA256 438af10e4a873de99d9ee9e1c93bff45b4c97788eda537120ec54f0a9ad26fa6
MD5 dfb5b23a858182e4e93137f15ba20eae
SHA1 6485169f7bff89b5cfed929c79b45b8e8abb3120
SHA512 c2b141d56f6f424cc8c172321b614f285855244c9b650fe5c6ee7f2529282c378e9bcab784126a1072cc4fa26cb0e6c3d85613c2d1170472eef3d20ead602da5
SSDEEP 12288:GaoVmp+54YlruxQXygjzqU/2Jg5V2oiuWXK:GDVmpeTygjzdvZiuWXK
TLSH
T175C47B2173E840E4F5B7563489728624DA77BC665B30D78F13A8966D2F73A808D39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4068	dump32.exe
4860	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2976	4860	WerFault.exe	86
3108	1524	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4860	eventviewer.exe
4860	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4068	1524	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe	85
PID 1524 wrote to memory of 4860	1524	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\dump32.exe
  "dump32.exe "
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 1660
    3⤵
    - Program crash
    PID:2976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 1796
  2⤵
  - Program crash
  PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4860 -ip 4860
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1524 -ip 1524
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 219KB
SHA256 f47d8d846bfc2fe45b1ea003b7f14e5fdd3df5632c5ee13de25ee70072619902
MD5 30a463363aadda6dc4d568e4fb2dc558
SHA1 ae61c19b65d6a16208c8200b094ab906604f18fd
SHA512 05bbda587745ee3411f7a86d2b9e69989c77ec53d61cb31e6b3e6fd31242ce931208cf72d2f9fd64a362907763b93949151585ba6209ede43dec9fb5340a0f79
SSDEEP 3072:PlOqHpRG6D1xv1XsfQXFJeb27hEgtQk9IMBBKDN2:Plrpf91rJtH+MBIY
TLSH
T1D724182C6C77F561BDA98E524DEDEA9663E7BDF61621030F0E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 eb68cb0f21f5668437318f4bdd94613a4df3977d818f5c831d81ca19ee982463
MD5 86442e6e6df019ebb060bd41dba967fd
SHA1 f5483be87761145760dc2d8499d34d1015cb0c1b
SHA512 87f7d7a9d8833386280ad9b5d2d5cd85c01e984ae188364655af14bfb9e2d7609a2ec770f8aec6b4b91368fcb69ffd82d53ca40b87582b70a01fbf836c1ee520
TLSH
T1B5C022082A830300F28C0B3C22803202CBA08A00E0808F2A00F20A08C223A083820C3A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 fbdb924bbd42d831497beeb83095fef219f5703fa91e2ce95b417deb64df8af8
MD5 b22836ca71009702f031ab8d0b2d88c6
SHA1 c4a28c8200a1e31ff867e36c49d97c9737fa82a5
SHA512 c253b8e1f37094e1b0d8bdc282966013cc5bebdc69f41303c56d3d24ac32959575196f0fdd4b24fc5d49c550f930115457cb8892c644626d618f6d462d2e73ba
TLSH
T18DC08C1C1AA20A06F2A8437C12C13D039B608901E2818F1516F22A08C992B163838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 1629f0465c90d6b59ffde88f27510654352d54239c7779e792fbab00eb0e6c0e
MD5 752e11e997ad8eaf03b77c9993b68d5c
SHA1 7a5c3df63b1f7c4bde4f1af86fd761840c048fbc
SHA512 5c7c1e85ce3c68cd454fe813743b0c9271b6ab0a87f812d6cca8d16152c42492da648ab57764f61b937076859d407168fdaec628e10db94853235ebfb9d85794
TLSH
T14CD0222C27800152FC73D23F80FA0002BA0025E371F18B5A0633064C1C21F021C21C0D
MD5 SHA1 SHA512 TLSH

Submit Download

dump32.exe

Path C:\Users\Admin\AppData\Local\Temp\dump32.exe
Size 333KB
SHA256 16f413862efda3aba631d8a7ae2bfff6d84acd9f454a7adaa518c7a8a6f375a5
MD5 a92669ec8852230a10256ac23bbf4489
SHA1 4bed038c66e7fdbbfb0365669923a73fbc9bb8f4
SHA512 86b2795a428799b1024c84cdb76eda787ade15d6895113a6e2c8db1635574fc48d5dbbe17b127f8bcc1ea092c19d9e215cefc8985c18a0fb0910e4548eb544ed
SSDEEP 6144:5ulvQXyijj2FO19VXUjUGTFqxnf85DAK/THw5+VUQwnKK5V2Ax:5uxQXygjzqU/2Jg5V26
TLSH
T14174185573F800E8FAB3AA3899728505DA777C565B34D78F0368416E2F73A809D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 fb1dc6bf1654b28dc6c9b9b6ca4b8eb989bfab98391430b43179b15d370d524f
MD5 b051d4ad3bc6a7eb9b1b19c735deaf06
SHA1 26f44a06a4cc3ec1233c098d6cc9b7161ef0fff2
SHA512 dff7eaba5c210136440d97ba297305b847b440ec4363239bddfc70ca1afadec8d47d3a23bbbfdb11b054838859958919615fc4f779b103b9f5fa68b0f991a541
SSDEEP 1536:zJAyOaasJD06LFOQpbHtphwSHPPnOED4LZFasOtN9WlQIz:pOUXpxvMZ+tIz
TLSH
T140B32B7163F00ABA60C343A47B6476697E55D18BE113C1ECB3BE52516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads