d6521e1b173f13006914eee5920c32561a9ccc49174230bb332f93afaff0512a

General

Target
2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 416KB
Sample260529-cfbreaaz3w
SHA256 d6521e1b173f13006914eee5920c32561a9ccc49174230bb332f93afaff0512a
MD5 8fc985e79af3da1a40c6db5fbe5e3ba7
SHA1 9cf99ae9582daee3a653a35b2efb44b44f345f2e
SHA512 2982accdd3b04a3b819fd73364edacc7bfd46d12ad553b363cdfd0b385e560af38d0f59bbd3d0dc6ac8f315e8ba8b9fab6e3e17bfded647b4c9fa9e44e565eb5
SSDEEP 6144:GjuDOhVLS5nj+CPXIYj37KoNX1KcwVz4B8xiuW1FXEl:GaoVmp+84YinVBxiuWXY
TLSH
T102945B2635E81EB2D1EFC1748AE18A76A33BFC705D204FC753416E0D7D369819D62A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5548	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4548	5548	WerFault.exe	79
5780	4388	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5548	eventviewer.exe
5548	eventviewer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 5548	4388	2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_8fc985e79af3da1a40c6db5fbe5e3ba7_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5548 -s 1556
    3⤵
    - Program crash
    PID:4548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1440
  2⤵
  - Program crash
  PID:5780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5548 -ip 5548
1⤵
PID:6080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4388 -ip 4388
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 219KB
SHA256 d2a4511b1b9a94e8ff66f074629b9445bad2a7f3c1b1405c3651e4666146a4c1
MD5 25f67c86141041ade6935fc0ed43a2cf
SHA1 3f75fda7d5e0a5604a709226777b0dbc8f98fee9
SHA512 afd117e12a0744b97c937b9a0743ba68b5288c845533fba378807b5de526295b8939743535f5dd63643482488e03e3ff30d966992344d5864d0ac3b083881f2a
SSDEEP 3072:6lOePpzG6D1xv1XsWrUp+Fb2dALdtQujI2JBoJNy:6lLpx91m2tHs2JyK
TLSH
T18B24182C6C77F561BDA98E524DEDEA9663E7BDF61621030F0E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 863dc9fd6269926d0ed1f3f431c92dd31e690e0db33f970414cee37d829c7a0a
MD5 60a2f57f68b6a2898da5b839c5325f43
SHA1 f84af20cd9900ede525cf447a18a6c0855700179
SHA512 48a8d14a461212892ca3f54cb67492973f3abc0ad2590fb1f78edb67842d5ecd2631300cadf489e90c85b5747731c3c40fb50af0a885f67fda338bb41731df1e
TLSH
T1ADC08C1C2EA20A06F2A8437C02D13D039B20A101E6818F1626F1AA08CA96B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 fcd0dc9b12bdd196287a012d791ac801463437f187f6a2161bdc798b833d4d12
MD5 b08d38bb98dce5d3a8566324f38d8ab1
SHA1 734359eb1d79049afd10d56bded1cdf74dc7cef1
SHA512 0d8e04410485792f9a594bbb640c25bbfd934bd9518dce22460ccd2a64bfedcad8569d4213e60f9308eb89ce7002bfe3b8c7abd852a23f5ca184fd5fdce84419
TLSH
T1EED0221C5FA00623F228C37C80B2020AAEA02023F5F08F1C10A0D50E7C36F013C52C0C
MD5 SHA1 SHA512 TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads