438af10e4a873de99d9ee9e1c93bff45b4c97788eda537120ec54f0a9ad26fa6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 570KB
Sample260528-dd39baes7l
SHA256 438af10e4a873de99d9ee9e1c93bff45b4c97788eda537120ec54f0a9ad26fa6
MD5 dfb5b23a858182e4e93137f15ba20eae
SHA1 6485169f7bff89b5cfed929c79b45b8e8abb3120
SHA512 c2b141d56f6f424cc8c172321b614f285855244c9b650fe5c6ee7f2529282c378e9bcab784126a1072cc4fa26cb0e6c3d85613c2d1170472eef3d20ead602da5
SSDEEP 12288:GaoVmp+54YlruxQXygjzqU/2Jg5V2oiuWXK:GDVmpeTygjzdvZiuWXK
TLSH
T175C47B2173E840E4F5B7563489728624DA77BC665B30D78F13A8966D2F73A808D39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1796	dump32.exe
3356	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4928	444	WerFault.exe	80
2448	3356	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3356	eventviewer.exe
3356	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 1796	444	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe	81
PID 444 wrote to memory of 3356	444	2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_dfb5b23a858182e4e93137f15ba20eae_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:444
- C:\Users\Admin\AppData\Local\Temp\dump32.exe
  "dump32.exe "
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 1404
    3⤵
    - Program crash
    PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 444 -s 2000
  2⤵
  - Program crash
  PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 444 -ip 444
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3356 -ip 3356
1⤵
PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dump32.exe

Path C:\Users\Admin\AppData\Local\Temp\dump32.exe
Size 333KB
SHA256 16f413862efda3aba631d8a7ae2bfff6d84acd9f454a7adaa518c7a8a6f375a5
MD5 a92669ec8852230a10256ac23bbf4489
SHA1 4bed038c66e7fdbbfb0365669923a73fbc9bb8f4
SHA512 86b2795a428799b1024c84cdb76eda787ade15d6895113a6e2c8db1635574fc48d5dbbe17b127f8bcc1ea092c19d9e215cefc8985c18a0fb0910e4548eb544ed
SSDEEP 6144:5ulvQXyijj2FO19VXUjUGTFqxnf85DAK/THw5+VUQwnKK5V2Ax:5uxQXygjzqU/2Jg5V26
TLSH
T14174185573F800E8FAB3AA3899728505DA777C565B34D78F0368416E2F73A809D39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 fb1dc6bf1654b28dc6c9b9b6ca4b8eb989bfab98391430b43179b15d370d524f
MD5 b051d4ad3bc6a7eb9b1b19c735deaf06
SHA1 26f44a06a4cc3ec1233c098d6cc9b7161ef0fff2
SHA512 dff7eaba5c210136440d97ba297305b847b440ec4363239bddfc70ca1afadec8d47d3a23bbbfdb11b054838859958919615fc4f779b103b9f5fa68b0f991a541
SSDEEP 1536:zJAyOaasJD06LFOQpbHtphwSHPPnOED4LZFasOtN9WlQIz:pOUXpxvMZ+tIz
TLSH
T140B32B7163F00ABA60C343A47B6476697E55D18BE113C1ECB3BE52516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download