f514835ebd0b91ebda444cd742c94086eab9e6a1d5e7ddfceb586e678ecb43b9

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260709-ecth6act7q
SHA256 f514835ebd0b91ebda444cd742c94086eab9e6a1d5e7ddfceb586e678ecb43b9
MD5 68714ef9d5d4df58a7324fce897f5c24
SHA1 513d20b2372bc7e2dd5b26131604510ae5030174
SHA512 350bd81128b76407ce18b1694451789db2fe02dac6102bbb1c61f95d89e1d4ba2c703047102809166790be459273c98438e212bf9aee5d96aacbffcc0c0b0db1
SSDEEP 6144:GjuDOhVLS5nj+CPXIY8EXAe6QPqksB+EYDiuW1FXEF:GaoVmp+84Y82Ae6D1B+EYDiuWXM
TLSH
T138747C1136D08FB1E1AF443148A59E748BBBFC304E219BDB63947E2D3E31981DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1300	googleupdateondemand32.exe
2676	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1004	5868	WerFault.exe	87
5620	2676	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	eventviewer.exe
2676	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 1300	5868	2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	88
PID 5868 wrote to memory of 2676	5868	2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_68714ef9d5d4df58a7324fce897f5c24_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
  "googleupdateondemand32.exe "
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 1604
    3⤵
    - Program crash
    PID:5620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 1492
  2⤵
  - Program crash
  PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5868 -ip 5868
1⤵
PID:5760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 2676 -ip 2676
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 78KB
SHA256 2a269570a9ae4618e6b04b339d03d3a7ad337d1df5d0249bf4d6c618f0ddfc95
MD5 85f40b30574ed04685a4bd5912642b72
SHA1 8f826d6c88aff3f8ff85f20aec10f96cdc601977
SHA512 5c04d7db8f5b438c00b5e980775d498cff101e9bd81f3fdf7091a2e84b1d7a81006d063a5ebb7ed49bc9221aee8e38c71a6848327cb840cfdff2752846f1256f
SSDEEP 1536:Jp/dFPdAEid3H8VWLxRaa5cm8rddE+Nli3tD994QfnV5Ji24cbNB:b/6OURamSdZNli3WmnV5JjNB
TLSH
T1C8732DA8AF77F560AD4A8F6A4EEED69622E551D51D01032F0E307EB02F13A67BF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 7a0f670231d79388aa36295b60cd3c6086534c89250e7c416045ea0a1cdcaa73
MD5 444088ce6f6fe28489d82806e7f05a78
SHA1 14565e1c117c7caad432e8142d30e66cb7379aa7
SHA512 12ad50277d2286efe0db5f0772d7ed36339ca76d47048f3d410068d8ae7c75174a67a569c036f57ec186ee4af82e6262206d979861a5d1419de366107a6ca96a
TLSH
T15BD08C1A07A9033BF031C239C8B20283D9C43102B091ABD815E3978CCC3AF2229A1C1C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a8dbf13e5a1e0eadbfd713951633303f693b4bc5ede3c878505b85cfe3125edc
MD5 b221a1956b215cea650323b5256c3b2b
SHA1 a6649c5e39d3d3d6f7c930e3dbf5fc53f7ce8a51
SHA512 ee8f5ba591130221f5e42b45ec4c9bad444cc807997a1c4ac06a667f8bd5a3834e6f3adc865c7049c3a7cde2042e1d1d72d1e9c352f26e393481698fa1694ade
TLSH
T165C0801C19D10605F594437D01D1390357109141E6418F0516F12504D956B157834C29
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 9bf1ccd4e80e6eab4edb7db256242ccd1186d53cc2a48c247408a778da57a8cf
MD5 e719dd1d284fee5c421e87c577e7f51f
SHA1 a2358608e44897ee20e1b841edeee68b6ba09251
SHA512 ae72af5dd3409afca67156d579deb232f4e05e6a2c85ce5c902390261982438b74c1a4b00ca4dfb02c8661f59f2c7b993f8df6f454e6e827f7f7c5b869bb7853
TLSH
T1B8E05E116BE80204F5B70A3CA97365499977B77BAA01CADD0275008D1D26F62CD36B1D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 ac0400910fbfc6f7e3cba286bbb02045eda58e796ef7bd5a59f6b01912fb6191
MD5 9fe356aa851e903cf98b79d7b72726ea
SHA1 86fe46923e967730e32b4d85c5b8d6945264c6fe
SHA512 de16125e8cd07bc9af561718c7b6437190ef45aa9f8380a58e567f6aa36580df879b3a5d7732991142a53fb2cb55cbe6f88c3beb8e0a92ea14b784e4aa893181
TLSH
T137C08C1C46A10606F2A883BC02C239838A209220F3829F0126B52A08DD24F266834C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdateondemand32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdateondemand32.exe
Size 105KB
SHA256 74b1373752df8b259e44bc69cd0fce3e268c82c5814acc8155cb1bf36cca60cf
MD5 456c34ff37db338ef6108086f5d17bc2
SHA1 804a513f3b1ea72f1f194a0d7ad0a14a297f5fce
SHA512 f62d79675c77ebac4d125a7bd13da5bc55327d79c65bc338344b503aa9830c7cddd5897377746d81c2336757f8ae9ea265eaec26b92208fb83603c593d1890e9
SSDEEP 3072:zER5AhC48S1m2YPrh4qR8vlZksB+vsdqCWPx5:zEXAe6QPqksB+EYJ
TLSH
T1CEB36D5176D1C8B1E5B6493108E8DDB08A7DFD614E509EAB33D80A3F0F316C1D629ABB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download