5339c7a570eaae339fd4dcbe7d25512e6e051cf03d062e565eb667f7d2c1cde7

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260704-cfccyaev7j
SHA256 5339c7a570eaae339fd4dcbe7d25512e6e051cf03d062e565eb667f7d2c1cde7
MD5 e86de5f3dbe459a7d5e5cf7ad5d22300
SHA1 063d1813eef6605c995c9ad975575b6ca0548e5b
SHA512 6c418b18e55c80734ec544bd440573cb73fc074629f66e1f41edabb83e8231a7a9ff73702914d13e73644898210373d589886ef41a8812c24c84448ed3600288
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXE9:GaoVmp+84YAIkOkTB+weaiuWXA
TLSH
T12C747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4660	microsoftedgeupdatebroker32.exe
4656	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4080	4584	WerFault.exe	84
2908	4656	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	eventviewer.exe
4656	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4660	4584	2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	85
PID 4584 wrote to memory of 4656	4584	2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_e86de5f3dbe459a7d5e5cf7ad5d22300_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1888
    3⤵
    - Program crash
    PID:2908
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 1208
  2⤵
  - Program crash
  PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4584 -ip 4584
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4656 -ip 4656
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 66KB
SHA256 ae7fe1ed6f4aced416d301ed96cacc367ed5808df197423baec66796c1bd7bbd
MD5 0a98ce3ff7bc219c02168140290b7dba
SHA1 4ec80869d1374d141935d71ec172c1d1fd23d7cc
SHA512 80198108019c136e8d01f1214df01365065be8f70c8719d30510b122d2335a57e065f500d914617f3551d7bbbef164dc7a959e56c00a3118ec4f97feaa91a5ad
SSDEEP 1536:Wo/dFPpAEi33hsl74BIaa5oC8D+eWi3/DSwQBqVgODR:t/mG8IamheWi3qqVgO1
TLSH
T1A9633DA99F77F264AD4A8E6A4EEED69612E551D51E01031F0E307EB02F03AA7FF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 d122dc231ebafba16c396e8eb6e3e6e0744236db0e1bea677372cec9e75c7b47
MD5 d7fefd787eebabd1fc691ee65b007332
SHA1 4490dc57bdc27a03a77280081d56510bff30801b
SHA512 25b934e413a169e915b3102ee8361435e6e33e078be5096d846f34b63e70b0eed089366271388a1a12d109b3423438c3ea57ed5a2d5eacacf88b2954b55721b1
TLSH
T1F0D0801C17B51732F0A5C535599641838DD05400F0A1C7CB05A7571C8C3BD411D12E0D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 032b9bd74a7bc32d8d975196fc42f78445d14a3f60b95eab01b673a1e52267d7
MD5 f4208d29647d39a9dfe84550321353b6
SHA1 c7b9688ffca270977753d2165dc008ad8bbcb2e2
SHA512 c5e36fbe1a4a9986d3f3db1a71c1a950b8bece7c9f918b144e450320fb3ebd4eec115bc9c9066255fa6c77f97e89275563370a0996ebc54215dcedb687782e39
TLSH
T1D4C08C1C1AA20A0AF6A8837C12C179139B228182E6818F051AF52A08C9A6B163838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 111b1572450128d04faf73b3c0745b6db01abef3bac5abd5f78da44fc0820f87
MD5 c453ffe0203e31e65b2cea7a8e21e0a3
SHA1 d20b1f64c65cdbd93b3782767487633ec116f6b5
SHA512 6ffdf082e2771a567415aa295a7c5617a1508ba71874c2de7b96e948687147bd0e0c5bbf2a884fb7050a094ff3e91a0b2391e25b05a025677b4651f0583471e5
TLSH
T10CE05E112BE80204F5770A3CA973A6499977B7ABAA01CBDD0775008D1C35FA2CD3671E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 8680abd41b2c2a5c664858199b258e7e677f11ceb42e28ca8a1aa3c7eb53b27f
MD5 d681d4706cd6ab61575ee73e898b2f7c
SHA1 0f5156103b3a2954b8021ff5854863450ae7746d
SHA512 45b32028664ed31cb976e3d2b499cab1cbb035f48ef425f191f6b6c8fef235f7462739ed93ce0af6f3a1086f3ceb6d632fbe02253e50911e5eb8d09dfb6ac975
TLSH
T17FC08C1C06610607F2E883B802C269838A219111F7819F0126B52A08DE24F122838C69
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download