4d9895f6d2a4b8fd52d60ef54b6e0bd875cf93b15367fcc76d41f5a082182c39

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample261026-vxgcbsft8t
SHA256 4d9895f6d2a4b8fd52d60ef54b6e0bd875cf93b15367fcc76d41f5a082182c39
MD5 a4d8cd3bb8269604f3e87ad07cf4c48f
SHA1 6863130a3ce7d953b286cd78e950043071f66f6d
SHA512 9b5b419361f174829faca0c505037e51a2d2028edaa046eb407a7c965d1b657ac0ca73f9745abe63a08cf76102c4b1ad000849dc0d0af2e701071936a31ab09d
SSDEEP 6144:GjuDOhVLS5nj+CUXIYdWIkifYUGrTB+AleaiuW1FXEi:GaoVmp+j4YdWIkOkTB+weaiuWXj
TLSH
T1A5749E1235D084B2E1B508314DB2EF748A7BFC711B219A9763947FAD2E31AC0DD2A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4844	microsoftedgeupdatebroker32.exe
1832	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3732	3208	WerFault.exe	82
4672	1832	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1832	eventviewer.exe
1832	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4844	3208	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	83
PID 3208 wrote to memory of 1832	3208	2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_a4d8cd3bb8269604f3e87ad07cf4c48f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 1244
    3⤵
    - Program crash
    PID:4672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 1192
  2⤵
  - Program crash
  PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1832 -ip 1832
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3208 -ip 3208
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 22a92c33dfe2eb5fd0cc9580b2e2590d8b8c163d1c69a5a00d66ecc18dd6c625
MD5 6d3d490ef12efd81d074968a742978e2
SHA1 c269a9ce8822b7bace56b95e706ae544c89d4268
SHA512 f44af8711ae06c080b7bd7fa59582d18e3bb29f343a7f6c48b15fb297d3ae90afd1633ef646c6fb32bebe2ae9a6f0c314acfd3e318f53e54c4a5ceb9040b1f3e
SSDEEP 3072:phnmUfAZMwGwQWxDrcZ0BAhDhJiZQ30+sMl1m+JN:ppGxi0BiDhkZB5013j
TLSH
T17B140C286DBBB1619E0ACDE14CDAAE5612FD719F21027F1B4EF46ED01D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5ff2aa34e8547bedbe4c6710992062c080b97c69e8a629516450373486bca499
MD5 7b7207e38d611577c1e96f6f77d66c9c
SHA1 7a073fdf68a39c6b958c512436233b6962c06bc4
SHA512 fabe85f2b996f072f4e67eab6ef3b949a81587efb687b1e1e9c9cad1fca9c2dca82a1a4121c2eea5824021f7210c6f6252b82aaac50f4a6caf9456894eaa7675
TLSH
T1D5C0220C2A838200F28C03BCA28032828B808282E0808F0A0AF20B08822BE083820C2B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 61253740df39bbb70b2f55b1eb556a27ea2c61897d9ebbf9c9975eeb697d2e9c
MD5 87d0e767de3f737144254d24f5815888
SHA1 1d789c12d350e56aafb2b70bc1b528643658b59c
SHA512 ae1b24063c53fe6f08228cd4c8f3a5f225b469712f3d64ab71d7bd956f472a33d488bd2c45019fea098e1d3582e1cbaa8d6b6a27fa5f5052912cc79621f839bb
TLSH
T147C08C1C1AA24A06F6A843BC52C139439B208142E3418F051AF12A48CA96F163838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 90a43a3445987d9dea0323dc004a9ed00d7889aca240b4a46a4dad475d63e0a1
MD5 bb63be15096c2c580be250f8966fa519
SHA1 72dda83a9916028d57e0d0144eab6d346d02f209
SHA512 76667715f86a2e212571dff865aa6fa2bfbaf4b7b9149b91e02c05f7831c03060b032a482bad86ed3241e221825029a8050d8d08dce9321cf3cb3ceaf8176818
TLSH
T1E0D0802C1F625377F4388739DDB3150109D17500F5C04B4C05B4160D5D17B2214E1D0D
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 e792a6e8d87d7ed2bd298a847b038970c98f74ef2cf8bb98ec6c776664690f00
MD5 76eebb72ea4eb89c642cb687de243206
SHA1 beb82fedbd3d305d33362e36198f36a7edd1542b
SHA512 326d0f5b1452a2a45f36a34902fcf0c8d5ce900ca5dd0978e9f1c581be5d86793b61403879ed0163fdd069e9c8481e15208382042ae26218da94a719442458cb
TLSH
T167D022282BA243B3F5388339DEB319041AE0B500E2C08F4C1BB8160D8F1BB6225E0D09
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 92c345f8bef5df7579c2f6b7a7afd9f341841959283f144519fc2af5e4245bd2
MD5 b83ee55d9c62246d59f29d95776eca24
SHA1 59e4ce7b31fe75187f70ee2af081547fce3b0a87
SHA512 821a370bf3a44ffae20a39f748f8d5fd33c0bf3c56a4e274f0c4130a267d50adf910c9211cb64d3413bb2b4892754522177e17d8a743d445aab0c2ae2424b412
TLSH
T194C09B0C57554215F188577D115562C186905510F5915B1515B9460C9636F052470D56
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 8ac73480a215991a214b5bdce193e9de5ab242b860a370542d340b30629f183c
MD5 d5e2852efdde1f90bc189e843b6fc16a
SHA1 7f3dd469beb40395f133788e1a568e3412e34432
SHA512 78dbf68a4c80f94b7a2830ad57165bff8231c5febb1f400a2a47fe5b786fb4267499f06e50dd5943321927899d1820fba90ae74ba9740cf66d99e63c2ddd4bc4
SSDEEP 192:g4QmVi+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:g4QmViz24xhbyO+OmtzIYu6MklJ
TLSH
T19642C67B5825842226F1515F7BBFB208E026F2079541DCD1FE8C43052F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 5e154dd8e9a5d07aad613e1ae891610e2f4eb195022188121adde2480c7ba4b0
MD5 77c3ac02e2ca485180141b1869d3dfbe
SHA1 2185bc3d21b724bf48bec5c482ae49ef5143f65e
SHA512 c45f14798c3124097934ada543dbda69fcdd13494d6a86563fccd2cebd2b51b32a945be918fc7fa78ae8953bfeaee6a8597f1e87c8d3b56dd1c092aa64fee1ae
SSDEEP 1536:q24HyOTCasJY2asmyvmRUhyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:q1SOTV6MXpWCmAZBtRb1BAwMW
TLSH
T1A324287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download