2388b56ad5ee0d921462f156bc8721933b8f4e84db6aab30d722f85a6709f817

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample260709-eepmzscv2j
SHA256 2388b56ad5ee0d921462f156bc8721933b8f4e84db6aab30d722f85a6709f817
MD5 34c28bbdd02887dd59630efb39f9140c
SHA1 e734d13dcb44f1c4fb5356449d53dbb7e580d9dd
SHA512 912731ad2e4c436753941b607e7287f392f4f068ed4898fcd1440040176be7496234a9336681cdb852f1f9e4721d0eb4cf69483deaa50a3f445e4a08d092a8a1
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXE8:GaoVmp+84YgcP/aK2vB+WiuWXx
TLSH
T14E84381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1828	googleupdate32.exe
1392	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1372	1392	WerFault.exe	89
4000	1268	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1392	eventviewer.exe
1392	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 1828	1268	2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	88
PID 1268 wrote to memory of 1392	1268	2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1828
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 2108
    3⤵
    - Program crash
    PID:1372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 1788
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1392 -ip 1392
1⤵
PID:432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1268 -ip 1268
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 78KB
SHA256 2a269570a9ae4618e6b04b339d03d3a7ad337d1df5d0249bf4d6c618f0ddfc95
MD5 85f40b30574ed04685a4bd5912642b72
SHA1 8f826d6c88aff3f8ff85f20aec10f96cdc601977
SHA512 5c04d7db8f5b438c00b5e980775d498cff101e9bd81f3fdf7091a2e84b1d7a81006d063a5ebb7ed49bc9221aee8e38c71a6848327cb840cfdff2752846f1256f
SSDEEP 1536:Jp/dFPdAEid3H8VWLxRaa5cm8rddE+Nli3tD994QfnV5Ji24cbNB:b/6OURamSdZNli3WmnV5JjNB
TLSH
T1C8732DA8AF77F560AD4A8F6A4EEED69622E551D51D01032F0E307EB02F13A67BF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 e4cd3dcb279683b0e700c85a87c9c38df6c1737039e2b31d8ce18289b4570f42
MD5 2c174e96ff0d4eed1f3d25fbdab4e371
SHA1 e1b0a72009dfa16a69be556f0113b30669bb224c
SHA512 3efd9b7f9402e377bb8aac66614e8716ba90d521893c263bd654888074b67ed7fd9e3c4e2a5f4b51f48986725118c4f335345a5f6e95ef491857863b7eed7ec9
TLSH
T159D013150F550337F021C33545713947E6941152744257941BB3D74DCC6FF721550C1D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ee9032dc9c4c0b7c7cf658db6e2ccb36bb7d2563b8c8b031d484dec56241b66f
MD5 2d32f3743a99d123eed7d76288e5c9da
SHA1 8517d4132fab171c0da6a2c15a15e9aaeb862d93
SHA512 2dfcaae2a5c401c6c98822983fdc87e6e769a2faf1dc024e022ec18be15d55fd49a53c197ba3f0bf69588a3f4247095f8eca6d21c3a2c79bab11822159363adb
TLSH
T1F6C08C1C1AA20A06F2A8437C02C279439B219541F6828F051BF22A08CAA6B662838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 9a6b2db5906ddd69819421a88c768c3e4527d09e1a7211dcff343977c6b7c648
MD5 e12bebdaacb42cac63b4792428063b7e
SHA1 1a72de0c27ecbb81373fb87a3e478cbb3b2bfefd
SHA512 53ddac847a2d40cba34f7deda17de955228f4480472cab372da84f9dc0a4e18c98de88f08cb1965420da4734594ad7646267b3e4b43ef6c5ae482b65461e84c2
TLSH
T172C08C1C47A1060BF2A883B812C229838A209510F3819F0126B12B4CCD24F222C38C69
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 176KB
SHA256 cdb28f22865efa42632d4166c85bfd4460b08bf8eda0fc21a5e3debe475dff2e
MD5 1aa58aad07cefd723c627f99a34fbc71
SHA1 200810b41095d610b05c3c97efa05c69182c7e2c
SHA512 3237e39b1b222daf7d176daa01bc6d56e725c82cb7dc94e5e2e842ec0e2d4de158aa7b54ba0f7c31ef6ab2b1df2d37800becd76381c07d1529e9721a2f056259
SSDEEP 1536:xJAyOPkasmpbHtphwSHPPnOED4LZFasjG6P1xkN9WlQIW:zOPjpxvMZS6PvkIW
TLSH
T1E504B53713B018BBC88245F46E38BD2D6EC8DC87D25598D8776E0B406F898B5AF725B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download