f41d9b835c43576b4711f214191c93e8b9d7879a2826667806e462854a6546a0

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample260809-cja92sssfv
SHA256 f41d9b835c43576b4711f214191c93e8b9d7879a2826667806e462854a6546a0
MD5 96bc7e78619d8a4b7a41c9c3bf16f569
SHA1 5a04c1cb9c4d73e44aee05a0845680bea1956b7c
SHA512 524b5d19e6f5e598230df41fff418b403212e23bc86ef4db528855eb377096d1c57b8373e95683c03254a089b01d33946c22eb7f2823199ffd701516a6ef87dc
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXE0:GaoVmp+84Yb4lssmroCkiuWXJ
TLSH
T15AA45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3364	microsoftedgeupdatecomregistershell6432.exe
1512	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1944	1512	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	eventviewer.exe
1512	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 3364	4944	2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	88
PID 4944 wrote to memory of 1512	4944	2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_96bc7e78619d8a4b7a41c9c3bf16f569_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 2096
    3⤵
    - Program crash
    PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1512 -ip 1512
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 134KB
SHA256 95bee5c5de4e59fda42ee52a435759e51484cb5d1c6f88cd4dc1405b8cf54776
MD5 de29f97203d146e8d75f2918507737e0
SHA1 03118bf385f840041e85fb37bab09b9e0b4a7949
SHA512 4fc3061e701fa9532d91938f813fa42961599edf73e7d3888dc82a6c2e49b1ade1793c3787a3473bce1d11cc7330e734d3425a7b61eee3af0476de8328040b5f
SSDEEP 1536:DkL2qAip6YpJgzKYOwe2O3MA8tzO8ydDt+G6LTmHD8u5UjtPf/vDzyCl3Yc5yggd:a+vBiPxdQG6LSWZvvDzL1yggwZUpr
TLSH
T123D31BA8AF37F9A0AD4B8F564DEED69622E552D52D01832B0E307E705F13A5BFA57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 9fac45ab06d1f2d91bde6b2152250bce1bb59013fe0112c112d6869da4a73d21
MD5 50d6a562a0503a87e93b9b0385ad109c
SHA1 abec52cb753728503f1f571a5d63657e9b940f0e
SHA512 4fd5bec1720242d372b951de6d05f9593c02824c680176542da1c65503541dde223fe265c75694f2a524370c76b8873554ae1d453d62632abb6cb9b2db1b5e7f
TLSH
T1BED012342B561325F12CC6BE59714357D7E0291AD3914B8D1FB6598CD928F132CE1C7D
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 1f2a9b1cae9a4c80b9766b0c85222a4fda614dee686869365495ec7855325f99
MD5 5b4a508e451f1da54330e6b4dee1abd1
SHA1 c180871168fcad32249795490a901dfcf3ca3156
SHA512 fcd7f31694131497c1ea782ea8e040d7d65c75c72675367a701f7fade66e86bccb1aafbb2d2839d007d2ff61865a2c65e0d740576f2fd058660483de5a61e2c9
TLSH
T11CD012382B922321F22E817A5D60032686E12602D3908B8E0AB6460C8829B521CE1D2E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5df32b9c1d215c1122518a99cdb01014e52e07ef4a4b681e5663458fe9d1f77c
MD5 b2c7c118295a2e9117ee2b47c1321e9e
SHA1 80c11c602b91afbced7c432be83ac16e60d1de9e
SHA512 62549dc913a2b4887edc74e61ba6af0615c92d45a371e7bf0005b17804c64263ed6d04373bae8d5c53ed1d0ec2e30bce34233ec2a4e60e358e01ee2ac7286432
TLSH
T110C092086A926614F288477D56D272429BA09A41E48A8F1A0EF60A08966BA0A7964D7A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 55bb4a2ccccc606a0eaccdd3163c89c6da33cfbeb474bd54a05c582b1c4c3267
MD5 5b9c0c341da811888f6e59ce271349b1
SHA1 92afa40792c3abbfa625d20c1ec72fc6b63af818
SHA512 fc906be77116385c33ca644f662a400bacc4667d7f70927c5b43dd15f145b9719e31bd1c9375d104fca1640c781da64c768dfa23c8dd650aff27f117b5788f2d
TLSH
T1B6C08C1C1AA21A06F2A8437C02C239039B218501E2468F061EF12A08C996B1A2838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 f2799c5f01a43bae6adfeefe02e50cd77ef588bcaa4814239104cc1b06190cea
MD5 389997a569da5ad2ce325d7d69dd414c
SHA1 1fc6c61f888ebca6de8ed3b01444e39340774878
SHA512 360cd9824d09a82fc1255866f9b0a3e2f42ace5a6990ba4ff8a62e80ea0d5263d04059a7735aeb3a05ceec5789fba3faacacd416f2d408360bb0176da02efa35
TLSH
T154C08C1C0661062AF2A883B803C22A838A618110F3829F112AB13A08CD28F1A2834C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download