89cc8b669578c84fe6fad7c9615cecae76d36ddfd16dfdea151ab9ad7d823102

General

Target
2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260601-b339hadw2r
SHA256 89cc8b669578c84fe6fad7c9615cecae76d36ddfd16dfdea151ab9ad7d823102
MD5 6ebf2795911ef08d3ac258b38913fbcc
SHA1 6c4a71289040ff55f8f1a4f2b82fc09077f17b09
SHA512 a80ccaea529672fc8bb024db159c34d26c1afdfea776c0ac945655d8972c4d85ba59dd1a4bcc5bf36930263a97bab5c2f920a9c2d0022974f0dbbe9f4e813f04
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEq:GaoVmp+84Yb4lssmroCkiuWXL
TLSH
T128A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3136	microsoftedgeupdatecomregistershell6432.exe
3440	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4864	1248	WerFault.exe	80
764	3440	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3440	eventviewer.exe
3440	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 3136	1248	2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	81
PID 1248 wrote to memory of 3440	1248	2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_6ebf2795911ef08d3ac258b38913fbcc_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3440 -s 1480
    3⤵
    - Program crash
    PID:764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 1484
  2⤵
  - Program crash
  PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1248 -ip 1248
1⤵
PID:2360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3440 -ip 3440
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 217KB
SHA256 bbebb0eaedabdd16500d806875250b077f9e3545965fc11ea0d6649930b32219
MD5 b2fe68114ef54fe3435a6f6d2c1ade0d
SHA1 dfbf05d8ccc2320b151f4f10428fd2726b5b00ac
SHA512 5f7f933b21112ae9b2363c201189de314b5820628bf23d741b478da2ba22ac6a1021e326f47fc76828b2ce192fd63fa169881bde414afc2620136abceb331a86
SSDEEP 3072:AOej6XG6D1vv0X8ReUdfxz3zd1/Lto9eIgOe8R09:Af6lX0Ov1ti5gOT8
TLSH
T18724192C6C77F561BDA98E524DEDEA9663E7BDF61221030F1E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 303afaed3e48774670224fd2934d7aea4bb92fc1689e888e00aae0e9ab1e0a69
MD5 0e6075e85675badd6f815831f936a142
SHA1 c774c41358e68bb63f97c9ae8f1dfa82414af8a5
SHA512 bfe025c16adaeeb3fc077ef8db6c503a98792976f3a4e885b132930f0ed48663b449894679d7c7fbda773ca59eb837851202d02c032b14387cebf8f7e275c860
TLSH
T1C0E05E122FE84204F5770B3CA9736545AD77B76B6A51CADD0275008D1D25F61C932719
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 f2a90895c6cac409d8b0a7ca303b042191a300215ceded985c8cc5cfb2468993
MD5 dbc3703712412b793472d80a4275e57c
SHA1 1af3d07b090c68cdbb222a51d007d761d7ba35af
SHA512 8aea87241bf6e1f1f4cbd3d4039a27a88c614d30b3b69cb4da46e002f80d993a6fd984b58c9af68da4e1e65b840a544d342ea1466e9ed46cb1e3d2bcb21ec564
TLSH
T167D0225C0FD10332F210C33405714E04AAB1B002B0A1DB0E01F1990E6D31F23283090C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 111KB
SHA256 16c384fd41f11dd96cb4355b61b1195a17a76a6fbe8d992091979098cc479d06
MD5 3c35b183e23299405c0a6d900e55f55a
SHA1 71c0f25e441206e8e5669d8ed2daa51a72faba2e
SHA512 48df58e680b80bbb6a72a3eb436b2470801ba54d6d3d35f998f1dc5f15151576c2341a1df5a513c248e0a039a6febc3b3f18e51d82a65fce7029ffd15d707275
SSDEEP 1536:mJAyOaasJD0gJLFOQpbHtphwSHPPnOED4LZFasOtN9WlQIz:qOA1XpxvMZ+tIz
TLSH
T136B3197163F00ABA60C343A47B647A697E55D18BF113C1DCB3AE52516F83DB2CC27A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads