b6a44148f8ef88f967c3ead7080b3f4ff8c973895aa672febf59769c1e9ad730

General

Target
2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample260828-mc56ysweph
SHA256 b6a44148f8ef88f967c3ead7080b3f4ff8c973895aa672febf59769c1e9ad730
MD5 ad1c27bf2e4694922590ba32bfb78a64
SHA1 a9af96905f786413bc5ffbea516e15c2f187fe75
SHA512 cc4f2a7554182f2602f45d07813553f4c4f97a1d07dac162ddbf4bfe2d0a8d21bd5cf90facd8e4c771759ff6903ebf07dcedb6d7f3ad74370ca657aa179259b2
SSDEEP 6144:GjuDOhVLS5nj+CPXIYAIkifYUGrTB+AleaiuW1FXEF:GaoVmp+84YAIkOkTB+weaiuWX0
TLSH
T19A747C1235D08FB1E1AF04314DA19A749A7BFC310E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2400	microsoftedgeupdatebroker32.exe
4868	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	4868	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4868	eventviewer.exe
4868	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 2400	4580	2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	87
PID 4580 wrote to memory of 4868	4580	2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_ad1c27bf2e4694922590ba32bfb78a64_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 1896
    3⤵
    - Program crash
    PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4868 -ip 4868
1⤵
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 40a8e43fd13e2d146a739de16a825e6097d889fbf8b12186ea35ec167422c4c9
MD5 11c50d7213282ce4813be658dc0c2795
SHA1 fcdb48b6debc39c7e19c7c70967a12e470438cb0
SHA512 99110a7c06d43382d61ce4c5cdea48110b524bd868e0c93a02ababa96040ca767b02a433c32e2714625f35d9369c3155efa0319334d8d6ff58f7fbb277067cf5
TLSH
T121C08C1C2EA20E0AF2A8437D12C139439B208501E2428F052AF13A48C996F172838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 a0143e4eb284399f624fd56218af277648a4cf2e195845363bb8f81fdb6662c3
MD5 3a9c64326f3a99eee126c57ed9723b7b
SHA1 aa420c9241556a5874692d29ffffce163a3a9bda
SHA512 eedf48108540d132e9a418f58903c55c5926bc379e3c06b7d26c8a07c55af080e160453adfedbebc96af1a5ded996a810dbb363deb4c78c398156cf1c3d808e6
TLSH
T110C08C1C06610A16F2A883B812C339838A218110F382DF0126B13A58CD68F122C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads