Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/07/2026, 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
- Size 438KB
- Sample260719-cc71fact2w
- SHA256 8bedfaf2208104d68ed1c252d805818cf7c5de4e0599fa66d582cd69d1a79318
- MD5 4223013f4f293f756a29728f2325a049
- SHA1 75de7b90980caed2cb1f9f49ec3de086c385788c
- SHA512 e86d34fcaabb51f8f1c4e78f96bd88cd17273d66b04048bd785aded053d84f7b044eafc555d51f111af41e1f7317db95006787189e72c6280921bde3f6daea51
- SSDEEP 6144:GjuDOhVLS5nj+CnXIY/Ael/DRfkTC3dM7B+mCiziuW1FXEI:GaoVmp+04Y/AelbRfky6B+mCciuWX1
- TLSH T10094F41237F84979F4F35A305C759F399A3ABC309E31E66E2750225E2D31A819D22B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1548 microsoftedgeupdate32.exe 5988 eventviewer.exe - Loads dropped DLL 8 IoCs
pid Process 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\eventviewer.exe 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe File created C:\Windows\SysWOW64\syslog.exe 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\google\chrome\application\140.0.7339.81\installer\setup.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\mavinject32.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jarsigner.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\addons\onedrivesetup.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\keytool.exe eventviewer.exe File created C:\program files\microsoft office\root\client\appvlp.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\cnfnot32.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File opened for modification C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\integrator.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\inputpersonalization.exe eventviewer.exe File created C:\program files\common files\microsoft shared\source engine\ose.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\7-zip\7z.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javah.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jconsole.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsimport.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaw.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\klist.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\servertool.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jp2launcher.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvdllsurrogate64.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\appvshnotify.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jrunscript.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\chrome.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\shapecollector.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File created C:\program files\7-zip\7z.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\servertool.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excel.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\createdump.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoftedgeupdate32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe 5988 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1548 1948 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 87 PID 1948 wrote to memory of 5988 1948 2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_4223013f4f293f756a29728f2325a049_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe"microsoftedgeupdate32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5988
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
- Size 701B
- SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
- MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
- SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
- SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
- TLSH T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 661b13536a27de43d1aad4b825aaef2f843b9a0cdb65429decad46a9dbee7aeb
- MD5 48d1428fb211cfbd20fc213af5517b7b
- SHA1 339f61e0ccf17ae570cd070d99eb5bf77fa723ee
- SHA512 26e1c93b1ac8c6068309dd91d227364ccbec006c88ab4f7d590f91f27d355d2c49653e19af0b6d266d5332d007ba3f61fb787c76ea6a919f204dfd7a7841474f
- TLSH T1F3C08C2C4A610A06F2E893B802C229838B208110F3819F0226B12A98CE24F126834C6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
- Size 201KB
- SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
- MD5 d182a0d12ca3a95fe1f2f5134861ae1b
- SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
- SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
- SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
- TLSH T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 812ce39b39b88424aec8cffc0aae8d460785e2f8a6f9405c27528f339b9cfdbe
- MD5 aff6ac09bb7ef8528f0f417195428960
- SHA1 931f54e5c70246f24f49235b28d22cd7af30aa0a
- SHA512 81da5d89ab43cfaa307b55e7f87a3f439c191b18a04b4653e670c74f6d8119244640018c4a013e2edd2f3256aad569c1313d200dcf78f29cb0cc660a3d5d7138
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CZ5XIYuQB:GjuDOhVLS5nj+CnXIY7
- TLSH T10CE36A1236D084BAE0B955314C6A6F7446B1FCB52932D71B73903A0E7E32B81D92777B
- MD5 SHA1 SHA512 SSDEEP TLSH