e7eefc1c249cb8ac4aedcfd884e7c45bbda0b8e768d299d7d139db8115ea1925

General

Target
2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample260529-cpr5raaz2n
SHA256 e7eefc1c249cb8ac4aedcfd884e7c45bbda0b8e768d299d7d139db8115ea1925
MD5 cee233007d0aa1addd15041adc3d9fbe
SHA1 e7cb1b10918ed30e788dee94cad6657fccb95587
SHA512 4cf86d7387407693f9a2d05f663126ff528549a12435cc0708d4f621bf5196e6d6f6ce3f1ae97685a0347db2093a1b95854e067094e0b4ffe3b17275328c98d3
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXEF:GaoVmp+84YgcP/aK2vB+WiuWXE
TLSH
T1D284381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
704	googleupdate32.exe
1944	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3168	1944	WerFault.exe	84
964	1596	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	eventviewer.exe
1944	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 704	1596	2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	83
PID 1596 wrote to memory of 1944	1596	2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_cee233007d0aa1addd15041adc3d9fbe_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1564
    3⤵
    - Program crash
    PID:3168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 1448
  2⤵
  - Program crash
  PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1944 -ip 1944
1⤵
PID:2448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 1596 -ip 1596
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 219KB
SHA256 d2a4511b1b9a94e8ff66f074629b9445bad2a7f3c1b1405c3651e4666146a4c1
MD5 25f67c86141041ade6935fc0ed43a2cf
SHA1 3f75fda7d5e0a5604a709226777b0dbc8f98fee9
SHA512 afd117e12a0744b97c937b9a0743ba68b5288c845533fba378807b5de526295b8939743535f5dd63643482488e03e3ff30d966992344d5864d0ac3b083881f2a
SSDEEP 3072:6lOePpzG6D1xv1XsWrUp+Fb2dALdtQujI2JBoJNy:6lLpx91m2tHs2JyK
TLSH
T18B24182C6C77F561BDA98E524DEDEA9663E7BDF61621030F0E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 d8332797d37304bdabd6301a8024bcdfc1b556a492c0a563f84ed6f47da2590c
MD5 3608db324b4b0b78012b15da23cb37ec
SHA1 a1311ea634114221bb35d95a59511f6a5c18e36b
SHA512 1ab387557ed05558b460a63f1df30a8d71ed6e6cef00c7c2c440576b0be32459c4aa220aebf2c24341df7d13733b850088f201cd798a16f4c5a23f990f82aae8
TLSH
T182C08C1C1AA20A06F6A883BC02C239139B208102E6818F1516F16A08CA96B166838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 a6c54d20158ed4cb285a62fa5256f650a11b78da60b487baf8238c62e044a013
MD5 19cc198a461b5d9550c99b43647d35aa
SHA1 6d75ff36b3dcf8fc9a2ea3d6e2d82620acecd865
SHA512 6f2339b4fcfa35e758a7e14c4d1a0d5a7300fd0c5c4c4d48daaadf37b9ba23ae48d8dc41a74919ef60bb84d9b1c204f1ba086bc1130a4b9fe2e9ef4441eb4408
TLSH
T113D0121C5B950627F229C37D94724606BAA52522F5F19B6C15E1991E7C72F013C53D0D
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads