0cc28ee67f68fce86b23a3ddeb28bad8858b4ea80688d5e12accb14d415ef6d2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260709-eb878ads5t
SHA256 0cc28ee67f68fce86b23a3ddeb28bad8858b4ea80688d5e12accb14d415ef6d2
MD5 7525885ecd7e390cd20386c06c7d90ea
SHA1 0c9952b680fbf3e1e525443115a4d85f3e7afbac
SHA512 6982323bb43827af27343360e47f4abd073c298019f2654aa8fe0117bc1bb36321fc3e3578ecb608c085011e49805990dc4c8e52ce5e1d7505e61c95e5ea04eb
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEP:GaoVmp+84YAIkOkTB+weaiuWX+
TLSH
T190747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1236	microsoftedgeupdatebroker32.exe
244	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3492	244	WerFault.exe	88
5928	4920	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
244	eventviewer.exe
244	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 1236	4920	2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	87
PID 4920 wrote to memory of 244	4920	2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_7525885ecd7e390cd20386c06c7d90ea_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 244 -s 1588
    3⤵
    - Program crash
    PID:3492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 1488
  2⤵
  - Program crash
  PID:5928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 244 -ip 244
1⤵
PID:2232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4920 -ip 4920
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 78KB
SHA256 2a269570a9ae4618e6b04b339d03d3a7ad337d1df5d0249bf4d6c618f0ddfc95
MD5 85f40b30574ed04685a4bd5912642b72
SHA1 8f826d6c88aff3f8ff85f20aec10f96cdc601977
SHA512 5c04d7db8f5b438c00b5e980775d498cff101e9bd81f3fdf7091a2e84b1d7a81006d063a5ebb7ed49bc9221aee8e38c71a6848327cb840cfdff2752846f1256f
SSDEEP 1536:Jp/dFPdAEid3H8VWLxRaa5cm8rddE+Nli3tD994QfnV5Ji24cbNB:b/6OURamSdZNli3WmnV5JjNB
TLSH
T1C8732DA8AF77F560AD4A8F6A4EEED69622E551D51D01032F0E307EB02F13A67BF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 0ce2f7124aa0008ec190f3f1732363afc10f61c81fa560eb1de0fe7173461023
MD5 3401a75b0801bc272f751814a09fb3f9
SHA1 a24f6a9ea2b688e1096c66fb2bd70a47d8377b79
SHA512 4ca722fb81438215e6d68ca48a24142be0a23201eaf1bdcc8d7b7b19b7884453bebd68148338f9d91140b191d89748f36562857eadfa8bad55b2259af6dbd811
TLSH
T1E0D0122A0F65033BF021C336A5B12947FA986112B44267992BA3D78D8C7EF722960C2C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 25694639c466120aa1b958984374a9bb0711d76213c358225132246b3f810ac7
MD5 403c0857bf0d1cf1f8ffc002792b11d3
SHA1 9d29661df6ff89769ef3c001a9ad1e361e628f35
SHA512 7b1b8c11397d18b6f3e4ec6a02158bc6a4845bccab0d1cd605e57c97cbbcde7b0f0fd410498e28396b607fd5f164e01918e2abd3c30bf4c3202673517500d257
TLSH
T1FBC08C2C1AA24A0AF6A8437C02D179039B209241E241CF091AF52A08D996B662838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 b7886f243a6e1c77750575165e5536e4ce89d488df41507e3b2be123098f53ab
MD5 217f88cd1070cc4f0275f109a850922e
SHA1 eb822edf6494301fb4a88e2afd7423286a94ce64
SHA512 7eec2d00bb2fd7485879db6172812e76e989d13ef4db888be2816c8beacc274c87a48ca44e94c925e02ea2139c962563c7f453fb56e7df6b7e44f05494dcbd3d
TLSH
T113E05E112BE84204F5770A3CAD73A645A977B76BAA01CADD0279008D2C25F62C933719
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c6530eddada81e8c4885ad88306d487494cb31cb5565453c5f6a0a9601e11d8c
MD5 7af6906e6b1146d5c4998e881c1fd1ab
SHA1 2bc47b330d3094a9cc9133f1ecdc0b5fde148853
SHA512 95fd83e4ac766c4598a5cdd2590036eb5f68401231d31ee7a0416232a51053234b07fb6dd8cbbf3970ac9173c83a45c726f91a65d1556d45310d9d2d456cb359
TLSH
T1F0C09B0C57514315F288577D1155618586507711F5915B1615B5070C9536F252470D55
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 176KB
SHA256 68a88baa38af5b11c91ed0d45366c75d2ddd7244ee161d70ade9e5bffa3d843b
MD5 90071ddbdd6ddd865f9f194c2454cec7
SHA1 9d53d3931356f4156bd5babf2417a7c7f5f3bcf6
SHA512 e4d9c0431bffafb264c31f18a5f9f1f64c2efaa0f915847fa436d0a9243b56dcb924ce1c5144fd5d420f54c78e504c43326fde7f9ac405dcdabd3f12b9a19134
SSDEEP 1536:xJAyOPkasJD0JN8EBLFOQpbHtphwSHPPnOED4LZFasjG6P1xkN9WlQIW:zOPbXpxvMZS6PvkIW
TLSH
T13504D73223F008B784D706D46E386D2D6DE8D947E11688D8F75E4BA12F868B9DE335A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download