d3b7298af2217180845d6bd1609457e9270d7ddce0be3b4b6ea19ff8fea07f8a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260628-2d8qssfv5s
SHA256 d3b7298af2217180845d6bd1609457e9270d7ddce0be3b4b6ea19ff8fea07f8a
MD5 58bba501b4d6ec6fc83b543075f6b7f4
SHA1 7326518b8476b074faa0e40482d32bb36edfd6cc
SHA512 4031ff82fab8e49879b1ea01d5c5be887ee8a7c8e421aafad13898d6cbdc6431b07614172eac5e884365eeea248965e871e36f0cc4d7bdebef32bb5bd1c9c26c
SSDEEP 6144:GjuDOhVLS5nj+CUXIYdKEXAe6QPqksB+EYDiuW1FXEM:GaoVmp+j4YdK2Ae6D1B+EYDiuWXV
TLSH
T15474AF1136D084B2E1B545310CB6AF748B7AFC701E219A9773A47F6D2F319C0DA2A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5800	googleupdateondemand32.exe
5380	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1252	5396	WerFault.exe	88
5760	5380	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5380	eventviewer.exe
5380	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5396 wrote to memory of 5800	5396	2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89
PID 5396 wrote to memory of 5380	5396	2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_58bba501b4d6ec6fc83b543075f6b7f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5396
- C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
  "googleupdateondemand32.exe "
  2⤵
  - Executes dropped EXE
  PID:5800
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5380 -s 1616
    3⤵
    - Program crash
    PID:5760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5396 -s 1476
  2⤵
  - Program crash
  PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5380 -ip 5380
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5396 -ip 5396
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 59KB
SHA256 f813cda15345719c1afb03043768f353d94632b5aca4a4e1e7089db64e92d1f4
MD5 07e8cc63235f69fb079a5e584fd04e49
SHA1 7c4ec6fde3cd96ffa73c69a1c7f4dade0cfeff66
SHA512 4efe4763c2b0553c46864d9dfc1f0b8efe9e7c474dd318daf21148156b63fdebc9fa661ba09769d50439fa474c9da6f8d6a0e81103f0434a636b07b7902c4492
SSDEEP 1536:po/dFP5AEiz3wawsOBzaa5o18VNSsDuULNA:i/uOVzamrSyA
TLSH
T148533E68DF77B264AD598E6A4EEAD69613E552D51E02070F0E307EB42F03AA7FF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 199778497dfba4a5fbb624a1cf7e3e3ed414388f2be72d4ce7d8a7d3fd466a49
MD5 793696acdf2fa854d599bd88a76a9e8f
SHA1 b61bd5f9b12f451b85d65c83ba7a4ef4626076a0
SHA512 9923e0e1224c8fa5c8a746d2a1de267cc0b1b6c07c541f29df88935a29e3169dc2f4d8f0bd254b026c5a7904a2daff026bb9c5beb721950aeadfbcf97aca38b7
TLSH
T1E5D08C166BE61337F451637644B08342FEE53511F0A29F4F0B37030E8C2AE120C62E1E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 831c24aac4542b45755a5fa15e2d93394402f0006743496f4e7d0ae85426aa06
MD5 2d7d96519e972c9e5270a81e919252aa
SHA1 8380617c49a52b39b4ce7efa7f14b71b6cab077b
SHA512 9e4a4956da256c3ee6c31d45404e8ce5cf2d4f7cedbbfd98f94fe9a72056ba81b14824f6a134d9cab04d1e328643b7ea66b19062ce1868de28ddd5fe8948e0ed
TLSH
T156C0220CAAC20200F2C8233C02803202AB80A280E0828F2A0AF20A08822BA083820C2A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 35b33f563b702f6dd8de260c24854f2d918013831dd29a6f3260cf18cecb1484
MD5 480de97fd5ec901baff9f718bd10a453
SHA1 ff76a129f6dd63ecfb97c1dfe8c22629754f1670
SHA512 acb08139b53765610c2822d78b5d59bd1da8600b8184684e16b4a1b5863086bfdea5d3c3aaec2f29ad9963f4b4f272da0eb27b24a12882ebe019122e554ce8fb
TLSH
T1DAC08C1C6AE20A06F2E8537C02C13903AB219141F2428F151AF16A08C9A7B563838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 9abb5fced8baeedfe8485bcf5a734f284062b5a2f9667141b220c23fd94af5d0
MD5 40687462a252dc8cd699d27e6f1935bc
SHA1 08863ad11b889bd9fabde14964e1ba35d3bf8913
SHA512 6439383e55a06838212ba1c0b66aaccee29bec41c6e81dc70546f7900817d969cc0cef40ae4e11c6035a9c336f1117c138ebf3c29e65b067d01d826c596f020a
TLSH
T119E05E127BE80214F6B71A3CA8736545AA77B76BAA41CADD0275008D1C25F61C97271A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 5bb14bd973c4cf8eccaa0f11bc1f08741651e63a9df03d63910b9bc5e8a3481c
MD5 5bcee7809421404ad71994b46c4c178a
SHA1 b500dc20be565d13ed283901f4ceec8b99bf1894
SHA512 0178fba9d521fb85320d7590b47e87319bc652bee6c774992d80949d87baf6c88cd66fa2aa32fd8d49049dec53026da96ab821af4f9234eba79da50f48781b72
TLSH
T103C09B0C57514215F1C867791151518196505610F5916B1515B6060D9536F056470D59
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdateondemand32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
Size 105KB
SHA256 74b1373752df8b259e44bc69cd0fce3e268c82c5814acc8155cb1bf36cca60cf
MD5 456c34ff37db338ef6108086f5d17bc2
SHA1 804a513f3b1ea72f1f194a0d7ad0a14a297f5fce
SHA512 f62d79675c77ebac4d125a7bd13da5bc55327d79c65bc338344b503aa9830c7cddd5897377746d81c2336757f8ae9ea265eaec26b92208fb83603c593d1890e9
SSDEEP 3072:zER5AhC48S1m2YPrh4qR8vlZksB+vsdqCWPx5:zEXAe6QPqksB+EYJ
TLSH
T1CEB36D5176D1C8B1E5B6493108E8DDB08A7DFD614E509EAB33D80A3F0F316C1D629ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 118KB
SHA256 df4cf37214e717b1a30b73cc1564054eb3ae618f8419915c6cde84061e4d6d86
MD5 6f6068d6c6137e667d258102739f2b1c
SHA1 4aa6f83d1feb0c10603a4dde71af5594efe97006
SHA512 2941e4b906619f1f981ff911a1028ee14d6fdb0e0580398a7e49fb9b513a0ca34fbdfacf5be6d1f6f0e8d17c46e2497f65191d0aa9154058b802fabd2cd57bbb
SSDEEP 1536:tJAyO0kasJD0OLFOQpbHtphwSHPPnOED4LZFasOMN9WlQIW:HO0+XpxvMZ+MIW
TLSH
T139C33B7163F00ABA60C343A8BB6576597A65D187F113C0D8B3AE16416F83DB2CC37A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download