ee81acb37a06205477733ddf073b4df7b9112919812674ebd897ee2588024837

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261026-va3xtags7n
SHA256 ee81acb37a06205477733ddf073b4df7b9112919812674ebd897ee2588024837
MD5 a929225773f71701e7f40e5e131ddd3e
SHA1 ca7fc87ad85f2287eb62093bafaac2a6779ec7a2
SHA512 b1e487ba89bf559d1b7df3130929687f72525799088e5c60b2d5d99425a1447919bc0c4463aac1faed012555693c474c138319590138807b59943af3a27b00e6
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXES:GaoVmp+84Yb4lssmroCkiuWXv
TLSH
T143A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5104	microsoftedgeupdatecomregistershell6432.exe
4156	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1760	4156	WerFault.exe	89
5668	1768	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4156	eventviewer.exe
4156	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 5104	1768	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	88
PID 1768 wrote to memory of 4156	1768	2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a929225773f71701e7f40e5e131ddd3e_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 2072
    3⤵
    - Program crash
    PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 1492
  2⤵
  - Program crash
  PID:5668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1768 -ip 1768
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4156 -ip 4156
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 932cceb221d912c3e2bf2c7421fd798fded273cb24842c10401c756b4114dac4
MD5 d1eff8736520fc453d41faa9d5db2a24
SHA1 94820e45eda46dccf1f5c0396af7394a3bf75290
SHA512 08ac6692f09ba3ee73bf40c8c16beee3fcd9c6dab3d2f4f643240ce23bfe63a8bf88951e8da29be04408633fb3a9577b64d99227582432e9485a6636b4290378
SSDEEP 3072:ZhnmUfAZMwGwQWxDrcZ0BAhDhJiZQ30+sMlom+J/:ZpGxi0BiDhkZB50o3h
TLSH
T1F4140C286DBBB1619E0ACDE14CDAAE5612FD719F21027F1B4EF46ED01D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 c2906fefd74b9b3de76a0316b809015fd693ed3dde0c5d30a23758b625603970
MD5 74ea3d7e759fee5212ef601b24087919
SHA1 c9296aaba06ec5f888679e53c07d4bc6a0fa8daa
SHA512 b40cba4acbb19c25683e8b609a59428707c0e4de9568015533d646220fded456df959a62ae17b855b83aebf53512ef2aa0f5605ebed09b12e9acd2fbe26a458f
TLSH
T167C08C1C1AA20A06F2E8437C02C139039B218101E3828F061AF12A08CAA6B162838C2E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 6bce3f1f7e402063c6386afcf637bf4a7aad9602ea12fc7a8b393406dcb28a83
MD5 512dd4243274596d26c50b75575570eb
SHA1 ae36084a09968cb2db07cdf818c7a1e7c1c3bf1d
SHA512 dbfeb1a86fc78a592b48a9a5c6b8a298299595663ca3c9b267b768f5521f39e2ce4f75f93838a88ee3da791afeada449fb07bc6e92bb0f58a694e1cb1e6356e8
TLSH
T178D0121957A21336F17DE77649600B82C6A26A36D9929F1A1F6D12286C6DF101821E4F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3489a6e960bdc8c669309cb73d6ed621021903e4cd5b3e72e8ad8252b70202d0
MD5 cf9bd2ae25a29195e052988c1d758e0d
SHA1 dbe875e280095f9a4d68ad43ff270a70a2f67be4
SHA512 5089cb472cf8c500d6cd329477bf7e86f609d65ceb16ae78946cb3c3554b1940d31a4fea05e79a3a622631e938280e9150c8152a67093a3a6f18e62aa43369f2
TLSH
T199C0920C5B524216F2C997B9129262828A909A11F5D1AB161AB60A0D9A3AF052870D6A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 defa463b1439ecb25c642af3d440beedcdb968fe422294a35b158ff8b6b4b65b
MD5 b97706775987b6c6b5b10594e142e37e
SHA1 65eb430344e12f8d035801a7926d5b14b493b90b
SHA512 45f10a89d524c1cea35412b992613ab3c3a7ae14d48b8e41655850630b4452dabe871eba91d3553a536172798c2e6c94f54453924594311280171cb0966dbfdc
TLSH
T118C02B1C0B610607F2E883BC02C23D838B618611F3C19F022BB13A0CCE34F122C34C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 5e154dd8e9a5d07aad613e1ae891610e2f4eb195022188121adde2480c7ba4b0
MD5 77c3ac02e2ca485180141b1869d3dfbe
SHA1 2185bc3d21b724bf48bec5c482ae49ef5143f65e
SHA512 c45f14798c3124097934ada543dbda69fcdd13494d6a86563fccd2cebd2b51b32a945be918fc7fa78ae8953bfeaee6a8597f1e87c8d3b56dd1c092aa64fee1ae
SSDEEP 1536:q24HyOTCasJY2asmyvmRUhyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:q1SOTV6MXpWCmAZBtRb1BAwMW
TLSH
T1A324287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download