ac302eb560d5975d2abcc3c59c614868ff5b63c0e89855facc1dff9761cc25e3

General

Target
2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260605-a92tksh13x
SHA256 ac302eb560d5975d2abcc3c59c614868ff5b63c0e89855facc1dff9761cc25e3
MD5 7c4d9f7896e9cb611af787a059916823
SHA1 f0577809218c25337d204b6449004eee1e8ca813
SHA512 d9da33f1f36e0e44cc53aabe7af324415a435faae4880cd10983c70b66d2d131a7126a47d74f2931aac44a31a1e824febb79cf9134f58a0a0cd6153bfcf0125b
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEt:GaoVmp+84Yb4lssmroCkiuWXs
TLSH
T144A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2164	microsoftedgeupdatecomregistershell6432.exe
4376	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2200	692	WerFault.exe	79
1816	4376	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	eventviewer.exe
4376	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 692 wrote to memory of 2164	692	2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	80
PID 692 wrote to memory of 4376	692	2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_7c4d9f7896e9cb611af787a059916823_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:692
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1568
    3⤵
    - Program crash
    PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 2044
  2⤵
  - Program crash
  PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4376 -ip 4376
1⤵
PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 692 -ip 692
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 212KB
SHA256 00f7c1214875f4051b4c8bec4f218f0bb36dcb8296dec3f53bd8ec7fd66331a7
MD5 556fe2697b70a4820b0d5d3754898115
SHA1 90092c3b8654c2b5d8e948ca84968aa073aaf8fd
SHA512 215bebbd600dd33e51ce35892829450c4774353a202936b6864b3de948758188d287ea6da745dd09e955c82835f78c03b5149e84ea3bceb1f736a9eae384cb4b
SSDEEP 3072:1ej+X3mq1Sv0XIRnUdfllj6Relw3t6w3IIL7DJmwn:I+NO05r7utFYIL3N
TLSH
T10924182C6C37F561BDA98E524DEDEA9663E7BDF61611030F0E346E502C13AABCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 eeb416eac8e14f3d1ece4a1d0b6da240ed2cfe12cbd3516c4a0980178cef8a4b
MD5 582f643f1e90027ca713eb1247459f17
SHA1 fea89bab7b4729812707c36019424a2a5288550e
SHA512 b8370c3797a4563231d6d44ad5e350c1409334c523903ba12b8e68ac710dd20c83b4826769e4dbd2dfd4158b611706f4c08dcb9ff0b0cf320a70eb83679e7ece
TLSH
T135E05E516FE84204F5770E3CA973A9499A77B77B6A51CADD0275008D1C31F62CD3271D
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 41b59b8bee077d05f0e94a5fcac1c123233586d1650ceca1ab0e03bac370c7e5
MD5 ad5aa50a6a4b673533e42b8d5bf0b255
SHA1 b1c119fd6bcb142e70a32437f685e0b4221285a8
SHA512 3cedebd7f388bde20deafbcfdf4a9677aba1d26ab35d07d9553a5acd2122a1bb72c2017cd99dc65c132411fcef270b1860f530e95aa44fe198c6ffa4b17ea30b
TLSH
T1B6D012282F664226E0B8C23698B40102E5F66A00B0A28B1B00B3D3485C32A2228A1D2C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 111KB
SHA256 2e3cfa397d01ddacaec8497e8a2953043d59608d11e236a205e41783cddb8478
MD5 265b26a4e150505638eb9f43b8fd0406
SHA1 4c589858c977b99865e5604d1f304fdcda531b4f
SHA512 586f4be5ee647f58871343f9e37281961bd3d42c6ac204fbca0f55c8ac5cacee5f21761ff6d1570e3cd2332dda59ccb9ed883e650df5a7c8561219c51e21d3c5
SSDEEP 1536:ZJAyOsasJD0wLFOQpbHtphwS9PPnOED4LZFasOtN9WlQIz:bOYXpxhMZ+tIz
TLSH
T14CB32A7163F00ABA60C343A47B647A597E95D18BF113C1D8F3AE52516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads