084a6e396069fe58900c74554ae1ba26be30b0f45ab12fcc9192cfa302bfd7d1

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260804-h7fsbsfb77
SHA256 084a6e396069fe58900c74554ae1ba26be30b0f45ab12fcc9192cfa302bfd7d1
MD5 4d5a1188be1b1db6a69a091e163c61ed
SHA1 02c566ed0e309e72af94ce324ece9f5719b3243e
SHA512 03d8e1a133abd2ae578c0bbecfda75f515e0d4a18f4b067956529d157284caebc2c023ebbad34cb8029c13a923bcdc80dc0cd791efa43169258393a381349339
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEp:GaoVmp+84Yb4lssmroCkiuWXI
TLSH
T162A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3208	microsoftedgeupdatecomregistershell6432.exe
256	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3268	3872	WerFault.exe	87
5820	256	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
256	eventviewer.exe
256	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3208	3872	2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89
PID 3872 wrote to memory of 256	3872	2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_4d5a1188be1b1db6a69a091e163c61ed_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 256 -s 1604
    3⤵
    - Program crash
    PID:5820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 1508
  2⤵
  - Program crash
  PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3872 -ip 3872
1⤵
PID:2552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 256 -ip 256
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 122KB
SHA256 3ade2ec227045f7e4737ff73ee3f0e2af1daf717ddb311fd0bdcb85b3d9b15e0
MD5 15aa6bd1ce9216b5e43d2771cb40ad4d
SHA1 2dcee16a71476b580ee05cf384043f5eef033600
SHA512 3574c74135108ac40fa67687663c03ab9aa0586a3d7bea4a11083905a76094896c6bfdc99d9d56c079b7401d47cef56d93fa9177841cf1d5c5c77b58b788d84e
SSDEEP 1536:llGqAip6YSJgX9MIxOqa54yrO8/dDt+lFLpmHD8u5MXtUeRwzyCAZYc/zgrWkyGD:/3WMjm1dQlFLw2d/RwzLkzgroToqM
TLSH
T111C33EA89F37F961AD4B8F664DEED69612E512D52D01832F0E307E709F13A6BFA57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 8ae9946e316816daa82651a343af79ff4cb1103f658499cbfafe3f3039930f04
MD5 f95e334f4102587c1864a68a10a3e4dd
SHA1 6891061d82e11f0aca60be6da2eb7ad1f2bbf44a
SHA512 436fb01f32fd9db596ee18189f302afc12dd51ddb3fb08a5ba3c03270bde07e0a1527d63a96f2d37cdde26d2390f3426862347f3ef47a673852b76394eab6421
TLSH
T112D0222C23600316F17F873A0C6001C3BEA47111B0630B4C2BAF24098E3CF018D20C8C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 47d99fb532776547d97f66d8bb1fc0109c811112456ef1761b4b32a80dd94898
MD5 b2959240017a8d13be9a882e160bc0cd
SHA1 12c088731752e290e7bd092fefe9b6d60c736005
SHA512 4ddb1d092a4854c29c536037f4148eef1fa351526d3d235fa01a0957dc44262dcbad306420b761b218ddf6e871a97c7e5eea7a6c320e4603b0e69a4f56f682fb
TLSH
T18DC0801C19510905F594437C01D139135B105101E741CF0516F52504CD5AF152934C39
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 48bd48fdd7a3f5a3e3e432381e4cb12c5f4aab051497b80cf580f7223b12a0ef
MD5 2556fa2d2f64d20cce9cb92cb9016985
SHA1 d0cdb673dbaffd6937f89c170211a79e734748be
SHA512 e5fb267caee960d2626f18124ef9069385d603d8f13aa9ce5e54784b4b6e5c240823362dc0b614962af46a2913c228781d1fd3c78d32774e4a97fde0ab7c14f2
TLSH
T119C08C1C16650606F6A883B802D229839A218110F382AF012AB12A08CE25F262838C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 197B
SHA256 ee019b21dfd921e5e75dddce9309bf62581cf87a118b507ee26952ef72202b14
MD5 9a9af20a4919e65aa8cf45077a79de43
SHA1 97ebfb7e486322abdc7a462f67d0c7fef24b8ed2
SHA512 0aaf39d48da28e50e7184e40b5e842558c7b681b144b979c025e114465fbb3d211958bcde7b9d84a274debd9a76857cd87a6a70063e3caf2a57f1dcc4e133645
TLSH
T145D012E738413C6DD4E3717D18835698F28485DC11F8611441E41F2332CB2966BC3B53
MD5 SHA1 SHA512 TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download