530b945dc0332ee979fe4cb8cfcf2124d62c02337435bbfa846c8724017854a1

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample261027-ev82kabt4p
SHA256 530b945dc0332ee979fe4cb8cfcf2124d62c02337435bbfa846c8724017854a1
MD5 e421f3779ff735f298b8d3944cad7d56
SHA1 b4b0ebbbb8ba9369bbe5f7ffa77b43643fe3b602
SHA512 1ce5a9e7b27d7686aa397c280361bf460a8166c8cd074b086dfc00beb08d293027e7d2e3010fada9a0c57ec72919838e4ec40ab26cb53a81e515efd4e14df79e
SSDEEP 12288:GaoV0JY4YlJi3drBRy9hdFIdhoyYTiuWXh:GDV0+ni/RyhdshPmiuWXh
TLSH
T13E94AE12B2E044F5E1764031CC619E35E773FC744B319AAF43A4AB299E336909D2BB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4652	googleupdatecomregistershell6432.exe
820	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
692	3036	WerFault.exe	87
1236	820	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
820	eventviewer.exe
820	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4652	3036	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89
PID 3036 wrote to memory of 820	3036	2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e421f3779ff735f298b8d3944cad7d56_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 1768
    3⤵
    - Program crash
    PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1476
  2⤵
  - Program crash
  PID:692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 820 -ip 820
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3036 -ip 3036
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 a5bb640e0ebe5419c3761184d54ef23948aee4759b1bff9e994a640ea7526e8c
MD5 2b7f5f7e0387b9236962d9310fd91b7d
SHA1 e3c87a9a849559d7969955edd3675937e42c8875
SHA512 ae679080eea6dfb4ee4fdfb7141ae19ccadf7176fc91bb28c3d5186b58962c48a6cdf14be4467af5ccf4c4c1a95120535c8716a7c05382c21dc17e44403decce
SSDEEP 3072:OhnmUgAZMwGwQCxDrc6IBAhnhJiZQR0ysMlpm+JR:O+G9vIBinhkZNF0p37
TLSH
T1FB140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6d65816868b563e31002f07261907a3000ba34ce59f3de24e7a3199c104dce2d
MD5 81af914e292f419d5f72cdea09c4456d
SHA1 be61b93a86d548f0ca3653d09ec3251a776989b2
SHA512 defbdb1a7c2e8ed882ae695c7401eaa5e288577af79e9eeaabef2a382d284da11b7aec0fbf9bf65e3601a390449d3743f048c37459db95c2b147b15560dc59e8
TLSH
T10FC02208AE820300F288033E02823202AB808200E0828F0A0AF20A08832BA083820E3A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5fb1dccaeeb6cbe634fa46d3057a14add59383c3503bbce2817170208b22f1ba
MD5 f1157a4f5a35f675703757c0b1ba1fe0
SHA1 b961f7201f1d50bae9e4495de55d3b3d825340b1
SHA512 b9c14703a7d0a8256b2000af9490e1c718b8ef82ed53449e4f6b897006f67815ac9c758583701cb33bfac234f2b2a34039dfc05730eb383d1f080df5d9d958db
TLSH
T139C0801C5D510605F594437D02C1390357104101E2418F051AF12904CA56B152834C39
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 82b47e5074c8e6eb28d490c9d3529accb4f2fa3449985be2a4bb3c72754a2914
MD5 44a2e952186179910499f10b22ab0258
SHA1 d41f96ddd0724022da6028e17fd3344636cd428c
SHA512 29350c7e43e50b4307e26c67fb2a5519c482e10a88db232fceba69600c91111350ca0ad4ee7ca96ea2df9ee3bb75e97630f7e17314b3881798dbe2d15df3b1a9
TLSH
T16CE05E727BE41215E5730B3CBA73A1854A77B6676911CACD0635008D5D35F20C83371A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 b2ba8cefb45f22b5600a3a390f4f734e50de01d9f9e59e7b89ea572d4295e636
MD5 0f0be4429b7304669b5d22ebd19adba2
SHA1 220529a8fb61c1558aed16b3cb82b65b9cec6947
SHA512 3509d50ebfbb5a294510896729a1b114fa6a6fb6a991facc2bb16509147db2102e686eb2292f8bffec54799a0d0189ed9db13940c4634bbe1a3a776aaf6e7141
TLSH
T19CD022382F100332F05843389B92058212D01A1BF482AF092FA2020E583CB822FE2C0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 9948d3f31ea87a8d0961f94ab99af4dd620e8a82df8327c73a4b7534a63fc449
MD5 fa5d521b5871ce19ae69f878dea5a3aa
SHA1 76a8e33732794218946b3447a9368d59b2404005
SHA512 3c08cf74a3ef411549f2895206f0bf16a511e7340b0f34868d7a7a3169034794e9ff91b2289a27645fe774efdb8b67a4c862d7a470501bff56255965d91de3df
TLSH
T1CEC0920C9B524715F28897B9129262828AA09610F591AB161ABA0B0CAA3BF062871D6A
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 57d065880e1e3d8659344e32e3230a57b0b8205787417c8380b42ae29b0d79e9
MD5 d5d54f9d637a66d13e008cfcb6c9472b
SHA1 8e7b6145516114c894dfa68a90c0f2eb3ab9753a
SHA512 a7352f205869fe95bb3a9090a13f057b5782c7128f989dbf7a02799af767647a7fc310d99b3954642b8ba6981322b8d42cc4c6f10ffd896b6fa5adfc9e93d814
SSDEEP 192:xqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:xqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T12642C67B9825842226F1515F7BBF7208E026F2075541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 df71e39edfde7b7fbd6eb641c2e384fa0d083f5a1c216ea019f31e4078653851
MD5 b94646fc0deb30c01adfa75f950ccf98
SHA1 e31bd6a1165dc9a8726322dd8c90e3b934b2690d
SHA512 dfdcc2327f857eed1a8d23e6798b878fd25fca1c35c7bd307500f111fc9f0a521240e57f43cd23a5a3d350feed79c9f7d77dc13023a6abab0d27bf11e242ccfc
SSDEEP 1536:f24HyOTCasJY2asmyvmRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:f1SOTV6TXpWCmAZBtRb1BAwMW
TLSH
T1E024287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download