2f900d4226848849fc3039735cc0c93f4cfd17101eaa4b4732941b87bfaad255

General

Target
2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample260709-edasfact8m
SHA256 2f900d4226848849fc3039735cc0c93f4cfd17101eaa4b4732941b87bfaad255
MD5 5f55f0f3f471e4ad7cbf566f68838ae4
SHA1 921e61cc2930a0523454d295330bc9159cf5a7d9
SHA512 ec8d849ca79e90017c95e3f1e54e67ab04c438bbc1b21c0a686b77834b93813a5996d6b1c0f44abf0a48ae85d6a84bf00166263ae0260e21ddb69b8c4edcdc5d
SSDEEP 6144:GjuDOhVLS5nj+CPXIYmMH7cCxP8psB+E9siuW1FXEK:GaoVmp+84YmO7cCmWB+E9siuWXD
TLSH
T165747C1136D08FB1E1AF443148A59E748B7BFC304E219BDB63947E2D3E31981DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6004	googleupdatebroker32.exe
5668	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3812	5668	WerFault.exe	89
4404	2552	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5668	eventviewer.exe
5668	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 6004	2552	2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	88
PID 2552 wrote to memory of 5668	2552	2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_5f55f0f3f471e4ad7cbf566f68838ae4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
  "googleupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:6004
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5668 -s 1588
    3⤵
    - Program crash
    PID:3812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 1500
  2⤵
  - Program crash
  PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5668 -ip 5668
1⤵
PID:5124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2552 -ip 2552
1⤵
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 78KB
SHA256 2a269570a9ae4618e6b04b339d03d3a7ad337d1df5d0249bf4d6c618f0ddfc95
MD5 85f40b30574ed04685a4bd5912642b72
SHA1 8f826d6c88aff3f8ff85f20aec10f96cdc601977
SHA512 5c04d7db8f5b438c00b5e980775d498cff101e9bd81f3fdf7091a2e84b1d7a81006d063a5ebb7ed49bc9221aee8e38c71a6848327cb840cfdff2752846f1256f
SSDEEP 1536:Jp/dFPdAEid3H8VWLxRaa5cm8rddE+Nli3tD994QfnV5Ji24cbNB:b/6OURamSdZNli3WmnV5JjNB
TLSH
T1C8732DA8AF77F560AD4A8F6A4EEED69622E551D51D01032F0E307EB02F13A67BF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 b87de4a4a9b11fb2fb1f2126b7262457d9eea91ff47c443cf8805376dd790323
MD5 6ae8c18425c349ff31f26edef7d3ca80
SHA1 3bb0965935b9071160ecc3f31d97c241952c58c0
SHA512 f997f3ee72348b4d7d70864b99cf1f95370a10e3fb2959a5b68b3031f790e63262501f5dc832ca6cb272e773ffa7a92e8c2f61b7e0b77055fb7a5143caa99946
TLSH
T1AED0121A0B65033BF065C37595B12D42EA982122B4526B982BA3D78D8C6EF721960C2C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 db5b44834b33dabee9ce0d5f7b65dc2b2577e5b108d2db6de71b02e9a49bb797
MD5 17fe6c60b81d414a994969f57c337d70
SHA1 82b572f080590b696d62e7ae01ca3e03bb631d44
SHA512 2f9869d7b851d9961e1b6beadd0a0398079fc4f1f653302db55f2a8a95ce71a3691b7c05dba5e8ddc51e5273b25937ff6c07ce98b0d61b8ab96ddd86fdeb5c83
TLSH
T103C08C1C1AA20A06F2A8437C02C13D039B209251E2818F051AF12A48D997F263C78C2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 75937964ffd910f18b7a3ac4068f4d055c24cc90ca0f7908e09533684158acde
MD5 3c426b2b065df0697025c16e3c6663b5
SHA1 ad3f54c0d91a2446eeb1ccc49851dfaa84fbc0a4
SHA512 bbe92efae2b5a461b14dd8e3a19f5890cc91ec539575563366329122f731e48e50edcfab32a3fc16dc7ffd445791a2bd08ec70cb3a6a30be533eab0added7d89
TLSH
T1FCC08C1C06A20706F6A883B803C22D838B209220F382AF0526B22A08DD28F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
Size 105KB
SHA256 d0558fbce5c91fa996f2aabf7aacf687fb873f2666a149af7d50ab4196add67c
MD5 10692357d5f73f6a020f76aba563fd4b
SHA1 87c8b47613a9c2f8b3e4845b5dc2204179750bf4
SHA512 9d06ba5f14e9345afb068e617eeea423f9274f572e12987df58366de71550e10d0e72a45ba4eea58da7fdf2740220fe73314f4a59b68b99ad186c40d4135e263
SSDEEP 3072:pMxJ7Rfp8K172YPrN4vzT+PSZpsB+vs+EOK1xc:pMH7cCxP8psB+E92
TLSH
T11BB36C1276D0C8B1E5B6493108E8DDB09E7DFD614E509EAB33D80A3F0F316C1D625AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads