6c95b83869c159c626c7caa2623c3bedc16b37324227dde3bad1e50c7d5dd79a

General

Target
2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260604-b7glashx8j
SHA256 6c95b83869c159c626c7caa2623c3bedc16b37324227dde3bad1e50c7d5dd79a
MD5 082dcdb6d6857998a9371a57dcb99fcd
SHA1 02fc3be149e10a6b00cffd5228043370ffa9a58e
SHA512 c18e5f1dc02a78d26f5e889edd70b07ed01dc640a1f751ffda191305426eac86fe34740a8b786cc79fbe558e5b89cec8c4151e6887f6f92279dfff2a38eae9e8
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEb:GaoVmp+84YAIkOkTB+weaiuWX+
TLSH
T100747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
444	microsoftedgeupdatebroker32.exe
1108	eventviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe
1108	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 444	492	2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	81
PID 492 wrote to memory of 1108	492	2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 0fe0cd1f15eadf1e880911d14464c0e39e80aa839473faa73ff7013e6420dd2d
MD5 001e1fef7cf83a844f7cbcccf204aed0
SHA1 f32ac8645ba85dc2c53e2c4e20fa7f1d38a24000
SHA512 0c1b4c8fdbdd5dd4a69874b135007c2ebdbd4295b805f8cdcd60fe51c9197a291959d469002a811993cfa455b8ac4cc5c6f220e9b3d9de55cb8d3c3827ddb6b3
TLSH
T10FC022082A820200F28883BC22A232028B808280E2A88F0A00F20B0C8223A083820C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d89f781a3fcb41b6028306f751298a5afe21503f5d691baa92e6005420546e45
MD5 0ebab776edc46e9a691540864fbf55d8
SHA1 1901b8f17cdf0d23a7c743431def7ff73e51b5fe
SHA512 236e180ac03aebb97b8750902ffc43eafc30099b2e2e41470eb247b4774f137fb0409a6d49afee83607076fb5f0ff12e6e93216fe81bd7914045775608068d1c
TLSH
T1D2E02E012BE80204F9730A3CA93361499937B76B6A21CACC0235008D0D21FA2CC3271D
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-04_082dcdb6d6857998a9371a57dcb99fcd_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
SHA256 6c95b83869c159c626c7caa2623c3bedc16b37324227dde3bad1e50c7d5dd79a
MD5 082dcdb6d6857998a9371a57dcb99fcd
SHA1 02fc3be149e10a6b00cffd5228043370ffa9a58e
SHA512 c18e5f1dc02a78d26f5e889edd70b07ed01dc640a1f751ffda191305426eac86fe34740a8b786cc79fbe558e5b89cec8c4151e6887f6f92279dfff2a38eae9e8
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEb:GaoVmp+84YAIkOkTB+weaiuWX+
TLSH
T100747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
MD5 c77a7e16f85637827514b13d5b586f76
SHA1 05775016364462afafccc226268373de15956815
SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
TLSH
T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads