44793342a72de2115c4912b30cbce6ccad000c6060bce3f876566e52e0128761

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample261027-ajlpnsxt7r
SHA256 44793342a72de2115c4912b30cbce6ccad000c6060bce3f876566e52e0128761
MD5 7185227e9c0291a8f722d677d7970501
SHA1 064cbcbd323f32275d505e139f1b04bf493181f8
SHA512 daa4e6f3b4ea37e0ba3a50215dfdd0e1bd77f780a1ed483c7d081ccc6758e8e4ddf2b6cd268ba32d3ea9e65c2addd2c776ae74a22d25267e972a0e998e7cc13c
SSDEEP 12288:GaoVLa4Yd0i3drBRy9hdFIdhoyYTiuWXl:GDVLa50i/RyhdshPmiuWXl
TLSH
T1D494AE1532E444F6E1B641308C629A35D737FC740B31DAAF43649FBDAE326809D2BB66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4816	googleupdatecomregistershell6432.exe
4112	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1976	5732	WerFault.exe	87
2848	4112	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4112	eventviewer.exe
4112	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4816	5732	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89
PID 5732 wrote to memory of 4112	5732	2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7185227e9c0291a8f722d677d7970501_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 1860
    3⤵
    - Program crash
    PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5732 -s 1328
  2⤵
  - Program crash
  PID:1976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5732 -ip 5732
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4112 -ip 4112
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 3ebb6ee565a0ba09e8db021782ba3f86326d1f613a77117000bf9ee6c3a6706b
MD5 4334febffbf2ac6b05617aed929d522a
SHA1 161ba25a5709a7d6ff57f4870d04b8309f33d58e
SHA512 a77d51fef8979b2d8d5fd2e12b399602cf7e2836ecad5f770a429d28ca46d4d7156e8b1c09e00737e094c41aba572c68d0c1789d2c01ec0ceb714443c8822ebb
SSDEEP 3072:bhnmUvAZMwGwQTxDrcC0BAhnhJiZQ30ysMl1m+JnX:bVGwn0BinhkZBF013p
TLSH
T13A140C286DBBB1619E0ACDE24CDAAE5612FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 94a6b5f51fb24cea43159737b816661732b79651719c10f9ef41d425e7577367
MD5 f9dafe4ca238139a2d0a7e39fc1714ff
SHA1 f1c34a1a36259dc1674da4d93ed7d578e5615f17
SHA512 594ba0b164c391bd3d898a6039761e395867ac69e62a38d9afb719a4c1e6c39419ab1f1d2ae976ecaa9088cd433f535d430416f92f4cfc73e181cc27e5c4d43e
TLSH
T19FC08C2C1AA20A06F2A8437D82C139139B208141E282CF051AF13A08CA96F16293CC2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 a7a7f1b4572e0402cf88a0d6a2c19c88d98d39032b4899125fc4efd09af57d71
MD5 ab93d1cb927d3a4818984c66d0ce7515
SHA1 40328ee18f1b31dc27ac17da7f72561cf7df8c03
SHA512 b8d9ac76b033d4dc26f3c6a084e7aa25fc418f730881981c792344bafa9f21a6e65a6f5a60ff295b4f28f09959da1f267bbddf0aa684cd93ca3c4ef163e4ee94
TLSH
T1D8E017627AE41215E5730B3CA972A1854A76B667AA11CA8D0634048D5D25F20C93671A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 9c4a280dd2e843e617534416ba11719a935ff4d588792646db15295f2211bd9b
MD5 ee9df3aaf5c74d33b4abe3dcfeaf8e1d
SHA1 c93bcd3b8ce90f5d4c53d46961badd50a51d7c54
SHA512 d8b77cb4d342c03d819d012cf8e3e81669d68a980f2bb32fd4fb872a12193c6979408f279285434c8da6cd660f4bf5818b39635d62f3bdc0785e67193b7e71e2
TLSH
T1AAD0800C6B914735F16AC5351430475056C17515F1D1474E05F6150D985AF001C21C0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 096e028b59098ad4514fbd33448e280bcdc1b992ecc36a98e5e8f4c435e4c35e
MD5 d3352d56ab49807a6a20103e85248c8b
SHA1 573ed08bfae3f8213042f2fee6b59f0601e7e205
SHA512 e52927a151ea861224c45f052ba12d967c662105f408e5b3b493e020d2dbf878bdbb51f1fb3ad8422cede69620952dc898ddb0fd9e15147ef09fe1d55653892b
TLSH
T108C08C2C0A610606F2A893BD02D229838A208510FB82AF012AB12A0CCE34F122C38C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 f1317ba1a9458bd3e0886a325da80bfe2e2f3f9cea0563859e46a220f2cd512c
MD5 9db4b61bc47c4facd47758cea3182eb0
SHA1 153cc8760566c8bcf5de84353ce75c3ddad52ecb
SHA512 5614a2b13d0a585543af717b83004c1e3520b7ef7d1fb3e760764da117a01ee933f3f304e3a0aee5268f6376ee5dff8fc0fa860961e0395a07b0cedb578c7f13
SSDEEP 192:huqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:wqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T17642D67B9821842225F1515F7BBFB208E066F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download