140d2074ef88dbae3bdc4088a1c6cd1235fc7520976d8978f87c9d75f7eb37f2

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample260629-gp398set2t
SHA256 140d2074ef88dbae3bdc4088a1c6cd1235fc7520976d8978f87c9d75f7eb37f2
MD5 7737f6629222c6da9445e94a84e16408
SHA1 c7296c44ffd40a08823b5356f0ede31b79b4978a
SHA512 796c46c3a739888758156ea2a5064bcdb056235aaaf989e5cdc1406c80c72726f1e1941242ab3c5a00f1b7e20e67943b19fda785e96299e536fdb0086e7a796b
SSDEEP 12288:GaoVmp+84YWi3drBRy9hdFIdhoyYTiuWXq:GDVmpzSi/RyhdshPmiuWXq
TLSH
T164947C1632D44EF5E1AF403088615A75E773BC200F219BEF43A4AF69BE326909D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4068	googleupdatecomregistershell6432.exe
2136	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2596	2136	WerFault.exe	90
4368	3164	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	eventviewer.exe
2136	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4068	3164	2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89
PID 3164 wrote to memory of 2136	3164	2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_7737f6629222c6da9445e94a84e16408_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 1816
    3⤵
    - Program crash
    PID:2596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1492
  2⤵
  - Program crash
  PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2136 -ip 2136
1⤵
PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3164 -ip 3164
1⤵
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 60KB
SHA256 b859c819182645510e3ff898dc36b9f08bcb6e4b0448cda7155e6d07ccd25035
MD5 eac3fe3547034fc5ad5dea5ac2118a9d
SHA1 e62832ec0ac421c492f6f608a977018d4c2b16f9
SHA512 a9be7f56aea7c9332fd19c2642931b3c12f86beac41623f8a87ee68cade326d38f1be54425793a3cbdc604e18ef898c49e1e5a39212fe0c20483a38c851d2afc
SSDEEP 1536:Co/dFPwAEiz3wacsOBzaa5o18VNSsDuULNgdX:x/7qVzamrSyQ
TLSH
T11E533E68EF77B265AD598E6A4EEAD69613E552D51E01030F0E307EB42F03AA7FF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 45864a7e78b36c5e3aa40d2dc7213db3193dd19127a92243fa646e972b51ea2a
MD5 29aa3949edeaafd2acc0aa41999f4c87
SHA1 697afa392c75f3622d1377fb93356398a201e05c
SHA512 34dbeb29ddd83a3032d82fea89242f00d19abadb9bc549d7f1a1294eb37fb21786055ee5f2aa1a8780072471d944dd806fbcf6020ccff432c7edf0520e9325e5
TLSH
T1F5D0A900AB9816A2F03B263E282002008A84B826A1822F4C1B63218B482CF124C22C0E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a954d365ea16066cbfdc5f78b6b0ff71a5dabaf4cb2557df8a533ffbd3466264
MD5 2f6ce287c045b9d517c35891a2314535
SHA1 67a370e56ee15690cdfaee911829a0116b6971f5
SHA512 4ffcbc9aa230b6b315081f59e609ff80d5e669d35b88343a824fbbfbcdaf92186d7c6798f24f56a27694affe48940ff838811eac20d88c4209b36a99e4c19496
TLSH
T12FC0801C59510605F194437C41D1390357244141E6418F0526F13604C957B552838C2F
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 1138a9376a366021c55333d79c6d19cfe00831c4efa325fa9962b94fa0fbdb4e
MD5 3d22c21612d66dfe49d8c513db4e2565
SHA1 a2f338e9437d7c183129023c0575bcca33928519
SHA512 27794e6b16cb88304f3462f61be2d85874ccd101a56021e60bb5900bcc58ffd010a7f7b965d1b47dd31f1d1a1be167ec67a82987bc1e2364b9a702228b36989a
TLSH
T189E05E517BE80204F5770A3CA8737649997BB76BAA01CADD0675008D5C26FA1C93272E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 30e07ce7943e2f9e015a92abcb59a726ec0893ea1dfcd483de6bfc3d99761841
MD5 ac8bd1d57a83e604da48ead597a00417
SHA1 f64e640607130cc44b2d2e3adc2458a3851368de
SHA512 8b82b480fe27cdad211e2b3417337516f812cd1df4e90730761c30fe7ece94efdce0a9432fda499d4b43ebba10b200c17279ac47473fad933f77d715fc376634
TLSH
T1ABC08C1C56A10A16F2A883B802C22983ABA08111F3829F0126B22A08CE24F122838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download