1340bce41f5c543a57712765f220a5daed7f518153cb551358ae919beae425dc

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample260928-qmxjcaah35
SHA256 1340bce41f5c543a57712765f220a5daed7f518153cb551358ae919beae425dc
MD5 9e09ab1566a0accc5b9a0cca00fc74d1
SHA1 4be6c26511b27877420a5eb132307ebc1a8fdbc0
SHA512 074c9b0a0d6b145553c476060ac66951452f4562831b22c22ef92f50ceb406fd3d0db3dd47eee4fc9e9e3104da488dc9bacd2dc4d35d01b677d58c2bf394c853
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXEQ:GaoVmp+84YgcP/aK2vB+WiuWXB
TLSH
T1A384381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1068	googleupdate32.exe
4676	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
224	1352	WerFault.exe	84
744	4676	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4676	eventviewer.exe
4676	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1068	1352	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	85
PID 1352 wrote to memory of 4676	1352	2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_9e09ab1566a0accc5b9a0cca00fc74d1_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1068
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4676 -s 1852
    3⤵
    - Program crash
    PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1208
  2⤵
  - Program crash
  PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1352 -ip 1352
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4676 -ip 4676
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D07CF1B9FF136D4730540DBA899C45D1
Size 178KB
SHA256 4084c1b75f9065b0e062b16c7528ad46722c64f18f87e995c2fae8a5a3341af7
MD5 d88f29e1e70809eeeeb75b9efcce0a40
SHA1 24382a4fd85574ec3f28fe8837773ab79680b5f9
SHA512 8a587865b7fe7a875688185d9ff6c5a37553989758ed6a4c2c8ae975210ea3499309b4b340b81943b09d5c78a42677d4e7684627465a406d773bec0ef33fdaf6
SSDEEP 3072:0dKAU7TFKdbI9Yqxw0ITPB8Cb/wcwWM9dyPjXiep:0dHUlSUpxw0IbB748PjJp
TLSH
T113042B642DBBB5A05E4ACEE24C9A8E9617FD61DD24127F2F4E346E405D03ABFCE17480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 3aa5e8b0c480c3693bd5bf22cd131ca74b97549b15b7c1f588b23e55b2c7bfab
MD5 5103e02b50dda504129f7c3a5cf9e693
SHA1 201ad27e5be615251195ad0ab11c6164cc92b562
SHA512 d970c4c0ff085a20143aa707ef35c8a425e8145610f49d43ce8bb3d45a429ca9c0f8dd99aef32d9d90e36d3dfaa9d6517f3c64a7ee0ee722b8fc2f69b4ab72f5
TLSH
T180C02B081A42C604F188033C1180710187805100D4408F0605F10708855B9043830C6E
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ebe16025b7c0dc57027b202c7895a04a9863d8e05d3c56359620ef5db2fbfab2
MD5 b17e1c3f263103da2d59ab10c65abefa
SHA1 85c38b770f454d2f0170386481c7137bcc674a30
SHA512 717e2f41c727d90328f4a8f7b1b0266da45762ce381f07fdc37e1820d0fcb781dceeb3c745b3bd5e7cf7aaf91d818dcb96b1708be812924938397442cdbd1102
TLSH
T1D5C08C1C1AA28A0AF2A8437C12C179039B619101E6418F061AF12A08CD9AB162C38C6E
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
Size 246B
SHA256 7e71ca9d12a964c6521851e5a70f8e9224b80687c96bcab1100a438104dce93c
MD5 5f5cdbe892812a917feffdf5d99ba37a
SHA1 91c3ea2eb9530979366721679966ad0dcc32d6bb
SHA512 204e72dad9e14f26c41319d9d614422e4b47dcbf9841e3eea8e9e918f85ce2e0c401aacb607cdfd2dfd4088ca40717d888b76e5da1a2f385f60507efb48c3a48
TLSH
T1BAD08C183FE12238F0284EBA8CB00643CEE0B601E1A1CB8E45E1020DAC2EE822C71D0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 ef0247a0696cee99a1a9f67d70f06f785338b37e1d7f118e62f5fe85c125ef19
MD5 9c47941ea807d3798353726d0018c68e
SHA1 7a5987591f615d65654a1675eac4ebe7320d211c
SHA512 b7fceb57b4b38cceb12da102afe2f19d27d3be641bf7d128a092dc387b56327807dbe90b6d430e5a0ad03dd3f43f0dda034cbc0d38bceff28b010b0a97023ed9
TLSH
T145C0920C57524319F29897BD2292A6828A909610F591AF2A16F61A0C9A3AF052874D6A
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 191KB
SHA256 0918d0a253ebbe2acb461128b1e3a7b73e087a06ad72a607c0135a8cba8c774b
MD5 d0eb980f2ebf1bfcd416576c0df8bc1e
SHA1 6a6fbbbf6775f51bfb6c4e2584c539835c5cbd05
SHA512 0d7019c82ceece36ab3e787dec8a6ccf9e932c97acfb5c3d6836141cbb697303afe652bff95912f849b0f55fbf72d478373cac260b5b006a7a638e3ba39e7ad5
SSDEEP 1536:V24HyOKCasJY2asmyLVRknchFOQpbHtp+wKPnOEDkLZBtMascblXNjW1Q7pjW:V1SOK6tXp+AZBtRb1BdW
TLSH
T14814187152F00ABA60C343A8BBA576697D66D14BF553D4DCF3BE42112F83C668833A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download