6aae655143657c76cf5185beb479fd40e14c987c21facabf208d06e37d978a36

General

Target
2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 416KB
Sample260907-2yctvsbg48
SHA256 6aae655143657c76cf5185beb479fd40e14c987c21facabf208d06e37d978a36
MD5 510b7b62f91e6ff7d634d6de71c2ae59
SHA1 14d2e2f344d964135697d1ed3216a07762741789
SHA512 408845c0bbb09a92c4fd16242b069968f19ceaddafb47960dedcc9d36e50351d3a1c94ee6e3685586b1f71d5b0942dfcda77dd700da658e0146eb2588f35ac77
SSDEEP 6144:GjuDOhVLS5nj+wtPXIYj37KoNX1KcwVz4B8xiuW1FXEi:GaoVmp+wZ4YinVBxiuWXH
TLSH
T1D2945B2635E81EA2C1EFC1748EE18A76A33BFC705D204FC753416E0D7D369819D66A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2828	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6044	4300	WerFault.exe	87
3428	2828	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2828	eventviewer.exe
2828	eventviewer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2828	4300	2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_510b7b62f91e6ff7d634d6de71c2ae59_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 1604
    3⤵
    - Program crash
    PID:3428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1716
  2⤵
  - Program crash
  PID:6044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4300 -ip 4300
1⤵
PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2828 -ip 2828
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D07CF1B9FF136D4730540DBA899C45D1
Size 181KB
SHA256 1aee2115952ea44a5f5fc8b01a00699b36bd6b371cb0beba945920e1f361fbb1
MD5 da967ed6b60f22c03aec83f0845dbffa
SHA1 1da8584a3144fb208b574c66990d70e694aa9471
SHA512 d3249835e94548ae7f4671cc8028cae3bcd3514f65c37905168b2dec35b596c318d4d3efba2030e42d5a9565ff3f5d9329e5bcd69a4360c47c20a50e0cc11ea5
SSDEEP 3072:44Ugu8yUZbhuMhj6M78wxdsIcyDSWrhwHxmCdQs1GQfu:nAf6/jzFDvxSWr6wxQfu
TLSH
T185042AA45C7BB6A15D4BCEE24C9ECE8616FD91D929127F2A4E347E405C03ABFDE13480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f6b653cad12585d020106e8e5c6ce3e240504ebfdf4736666596f81a281c9279
MD5 01fd438635ff17c89d56eef020f1017a
SHA1 0e38d53f4dbf646b2bf834b4299894d21cc64000
SHA512 ce45382154b33ddb0b5dd4a9c12109a1a28a34dd8d3b2b02c9bf0396fdf82c0e13cc7840de696013b9601ecd48d53a20dc5be3c6c92cd20737551ab2d0567135
TLSH
T154C08C1C1EA24A06F2A8837C02C139139B208101E2418F051AF13A48D99BB2A2C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
Size 246B
SHA256 a5096fae35dfb1057843896e7a7573ada42d649c2d5d024587be7a721b9af30c
MD5 7c5c0312e5274c0a393eaefb5f6cacb3
SHA1 1e4db175e41e8f803c8591ac8d9b723723e30e17
SHA512 3bd4e51dc3153e96b9b045ad11f634e723746ca5b4c12c1d1d18ff4946d95a7da32a5811ee85719f471a1d6ad6813373bfc549b5d69e143659dc0317e5283157
TLSH
T18FD0220827903259F038477D886155222B60660AFAA227081FB1621A692FF440DB2D08
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d6b8569acfb6c93f792f16a29149d8192795580b5ed96695c9c5bd85e83a221f
MD5 e0fcf87fa01d6fc9cce4741ea87c8f00
SHA1 11ae78ad7bb0302af516c58fad469abe20fc2c2b
SHA512 4b769f22e7e64486f185f29f8f58f3fdb3f07276742be965161902d50ec78087b859595de21c248f5b7dea5c078877e57ff1644412329e72276fa4e0cb5916b8
TLSH
T1B3C08C1C26620606F2A883B802C229C39A208210F381BF0A26B13A48CD28F122838C6A
MD5 SHA1 SHA512 TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads