1b359939c95d6ee2f89e8f3d2c45c63694918987ac73a95e88d26ee488b54a2a

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample261026-tqb9csty4m
SHA256 1b359939c95d6ee2f89e8f3d2c45c63694918987ac73a95e88d26ee488b54a2a
MD5 ad9535ed5c0a2107ea052e2ae8a01fab
SHA1 b1ac75e9ae8afc3b3da515cc1b927c73d205ff15
SHA512 c311f03838cc0cb17c7e9c20cedabc689a8826f5fca19e0b0918043d686f0b209939014b4354a5219063800ace1b31d017acd5308083bd83691db5d0dc0eb6b8
SSDEEP 6144:GjuDOhVLS5nj+CPXIYKAel/DRfkTC3dM7B+mCiziuW1FXEc:GaoVmp+84YKAelbRfky6B+mCciuWXV
TLSH
T10F94E31237F84A68F4BB5A305C759F399A3BBC309E30E7AE16502A5D3D31A419D21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5500	microsoftedgeupdate32.exe
4656	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3520	2084	WerFault.exe	87
2924	4656	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4656	eventviewer.exe
4656	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 5500	2084	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88
PID 2084 wrote to memory of 4656	2084	2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_ad9535ed5c0a2107ea052e2ae8a01fab_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5500
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1604
    3⤵
    - Program crash
    PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 1784
  2⤵
  - Program crash
  PID:3520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2084 -ip 2084
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4656 -ip 4656
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 2f5f2edb155661ad711be6bd8e0028408cdaeaebe951e8d36af7d9286389c0e8
MD5 f3e60185d5cd920c9503f604968dddae
SHA1 f09ce9d564757033644dace696989542c47269c3
SHA512 5a8180c04cad4da69494565e6ae8bff8ddfc1b7ebeca75b6db7eebe21387889dd4d9274f55edd2966bdca0bb23d15fe3c43ffe8389f6358f964fc2f14c1762c2
SSDEEP 3072:6hnmUfAZMwGwQWxDrcZ0BAhDhJiZQ30+sMlom+Jt:6pGxi0BiDhkZB50o3H
TLSH
T1E7140C286DBBB1619E0ACDE24CDAAE5612FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 103366f93f6682280193df5cb4c1410d77e2af92f8b0aa7d5df1af9877b66edb
MD5 a3f09a0d2345339f7f9c45e0902c7c4d
SHA1 0a48e4d784125b0bd91e400f1b6a59e940471e0e
SHA512 c88fd93abdd4b01b464d807a8ca1dfe4265ecf961fcab57be99b830dc9e05d87de8f4928caa132f52907e0a0850d9f9f7fccc0bb93af1a991b869962ca5dd709
TLSH
T163C08C1C1AA20A0AF6A8837C02C139039B228101E2458F052BF12A08CA97B262838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 8dd91002dc7d7b6e92bbb54a72f21210401af8dbd2d055474a2304bff047d4ce
MD5 83033b8ad05465fb292ddbe78bb5019b
SHA1 25f2047154396727918df01445a44ca8d658d2ac
SHA512 de4197a9b8369c90ed421aac5d28844271b78f4fa00e4427e3e0937b7a77cba4c454d57b2adfee693e3e37d8f1c38d571531d05bbe7b620f841b1a26f0e3799f
TLSH
T1E0D08C002FA31639F009863A48B50102AAD0E901B1A18F0C47A66A0D9C2AFA50C23D2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d2af1666611b6c569597c189dcd9f53b125562bd8f235d88494f7501cb745bc2
MD5 8f5560bf8cb557cf51fa7061fc556866
SHA1 ccce7ba651ea6f6e3586b54f78d93c9f31686e8b
SHA512 3badafdfa7c31518603a68f8cffc2d5bf3d96ceb6cb451d6a1bf175f5ad61e8a62616ca94237065b53d9472543f64b3759c57fcf2476b60993d7a26aebdbda17
TLSH
T16EC08C1C06610606F2A893B802C23D838A21C211F3819F212AB17A48CE25F622834C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 8ac73480a215991a214b5bdce193e9de5ab242b860a370542d340b30629f183c
MD5 d5e2852efdde1f90bc189e843b6fc16a
SHA1 7f3dd469beb40395f133788e1a568e3412e34432
SHA512 78dbf68a4c80f94b7a2830ad57165bff8231c5febb1f400a2a47fe5b786fb4267499f06e50dd5943321927899d1820fba90ae74ba9740cf66d99e63c2ddd4bc4
SSDEEP 192:g4QmVi+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:g4QmViz24xhbyO+OmtzIYu6MklJ
TLSH
T19642C67B5825842226F1515F7BBFB208E026F2079541DCD1FE8C43052F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 5e154dd8e9a5d07aad613e1ae891610e2f4eb195022188121adde2480c7ba4b0
MD5 77c3ac02e2ca485180141b1869d3dfbe
SHA1 2185bc3d21b724bf48bec5c482ae49ef5143f65e
SHA512 c45f14798c3124097934ada543dbda69fcdd13494d6a86563fccd2cebd2b51b32a945be918fc7fa78ae8953bfeaee6a8597f1e87c8d3b56dd1c092aa64fee1ae
SSDEEP 1536:q24HyOTCasJY2asmyvmRUhyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:q1SOTV6MXpWCmAZBtRb1BAwMW
TLSH
T1A324287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download