Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
- Size 449KB
- Sample260709-eadd6act4p
- SHA256 02f54ad317111e0a889e2d7a751700e66cf32ee34b4db7a21253101a1ca822b9
- MD5 ac9f3d5aae0516d15dc2021cdba21e2f
- SHA1 5ba3ac8c681c35cdbf3e5cd494061f443aea58c4
- SHA512 a12382a51291c0aa0d11636550d46c3a19c4d314ce8d8f16913234334f7a64942708ab058fb1becd2de33dc48fb3083e7a199caba20c3ddbf7fa9b6d0cdcf1ba
- SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEq:GaoVmp+84Yb4lssmroCkiuWXz
- TLSH T1E0A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5292 microsoftedgeupdatecomregistershell6432.exe 4384 eventviewer.exe - Loads dropped DLL 8 IoCs
pid Process 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\java\jdk-1.8\bin\jstat.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\policytool.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File created C:\program files\7-zip\7zfm.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\keytool.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\appletviewer.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\java-rmi.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excel.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\orbd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\java-rmi.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javadoc.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvdllsurrogate64.exe eventviewer.exe File created C:\program files\microsoft office\root\client\appvdllsurrogate64.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\integrator.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\cnfnot32.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\internet explorer\ielowutil.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jstack.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\java.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jinfo.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File created C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\createdump.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\os_update_handler.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\rmiregistry.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\clview.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\setup.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\wsgen.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jp2launcher.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\unpack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excelcnv.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jp2launcher.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\internet explorer\ieinstal.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe eventviewer.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4172 1956 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe 4384 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1956 wrote to memory of 5292 1956 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe 85 PID 1956 wrote to memory of 4384 1956 2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_ac9f3d5aae0516d15dc2021cdba21e2f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe"microsoftedgeupdatecomregistershell6432.exe "2⤵
- Executes dropped EXE
PID:5292
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 19162⤵
- Program crash
PID:4172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1956 -ip 19561⤵PID:2256
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
- Size 78KB
- SHA256 2a269570a9ae4618e6b04b339d03d3a7ad337d1df5d0249bf4d6c618f0ddfc95
- MD5 85f40b30574ed04685a4bd5912642b72
- SHA1 8f826d6c88aff3f8ff85f20aec10f96cdc601977
- SHA512 5c04d7db8f5b438c00b5e980775d498cff101e9bd81f3fdf7091a2e84b1d7a81006d063a5ebb7ed49bc9221aee8e38c71a6848327cb840cfdff2752846f1256f
- SSDEEP 1536:Jp/dFPdAEid3H8VWLxRaa5cm8rddE+Nli3tD994QfnV5Ji24cbNB:b/6OURamSdZNli3WmnV5JjNB
- TLSH T1C8732DA8AF77F560AD4A8F6A4EEED69622E551D51D01032F0E307EB02F13A67BF57000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 808B
- SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
- MD5 878e958d6bff424e59d1feb51584a01f
- SHA1 b11261559bbea40f1874448196e2934277a537e9
- SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
- TLSH T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
- Size 246B
- SHA256 ff02178f659bef62d67e05e4f5ecc279fe13abc2027009e879924b4808e26933
- MD5 d4b1e85417f89efdb14c3f5c0a45c284
- SHA1 d1728cf46aac63b8c53237f1493d2123d2b99285
- SHA512 0c4b65618bd43d02acc2c0a34593bccd55e701a0764780bdfd3427b4fc3b428a3929f65a34fcae95288e2b982a385e6deaa93af67fe1bd5f1aa89d0ef5ae9623
- TLSH T1E7D0121A0BA5033BF031C33585B12982EA982152B44267986BA3D78D8C6EF7219A0C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 50c2b9c3be8c278c9ffc182b1830b5a43696efb1d3485524f3c23c4f4cf3c893
- MD5 8b3641a736fd10f5d92267b32f1791e8
- SHA1 6e8df686d393fe922735ca3901551647516d6ddd
- SHA512 63f2ab58155000fef53573609fbf2845d28e30b9493fd995ad0d65efdb569bb94790c15528e0cb5540dcfc7581a0730e8d81e61d4ae16927c01ce43e451fee8c
- TLSH T1C7C08C1C1AA24A06F6A8437C02C17D439B209242F281CF061AF12B08ED96B263878C2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
- Size 212KB
- SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
- MD5 aa40483e78012d125b1b9d2fc64ee27c
- SHA1 0a00181082545626eb5644cac1cdb78904e476b0
- SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
- SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
- TLSH T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp72B5.tmp
- Size 152KB
- SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
- MD5 dd5645a32ccec6b1fd23a936699bc3d4
- SHA1 6007f779d59b92781fd44d97196ca742004f3cd7
- SHA512 22b48bb29f63a4b3aa2e44a2b88919e35a5ebf8a5e6c92d22f25f55e3bb08bc27420d2b33af15fc165989f2281d37c824b23cc574fc432c6aff05622af3157fd
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+CB5XIYNQp:ujuDOhVLAo5nj+CPXIYw
- TLSH T146E3481136D1CFB5E1AF44318DA25AA44BBBFC319D7297CB53903E0D3E359418A2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH