08b5a6628a430974d2bd981bfe607957f22c01bb4b3acb11be7f1c844705ea7c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 342KB
Sample261027-fn4nyacf98
SHA256 08b5a6628a430974d2bd981bfe607957f22c01bb4b3acb11be7f1c844705ea7c
MD5 dce0b89f3ef5b2c8e798e634648b975b
SHA1 20f4d8fbad8f87eef4916f96d2e9facccadb9c2f
SHA512 42b38505732eb92b00e2f3df5c10a3ec87b2138ee242b9c01c4cd53bce8df12b803bfec5bcad5353b3c79565a48dd365063214f22ef36a5b4c8384f3e3b796e2
SSDEEP 6144:GjuDOhVLS5nj+CYgTXXIYpMH7cCxP8psB+E9siuW1FXEO:GaoVmp+Dc4YpO7cCmWB+E9siuWX/
TLSH
T1BF74AE1236D0C4B5E1A945310CB59F748BBAFC700E319A9B73D47B2D1F31A81DA2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4632	googleupdatebroker32.exe
3628	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4628	5460	WerFault.exe	86
368	3628	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	eventviewer.exe
3628	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 4632	5460	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	88
PID 5460 wrote to memory of 3628	5460	2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_dce0b89f3ef5b2c8e798e634648b975b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
  "googleupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3628 -s 2092
    3⤵
    - Program crash
    PID:368
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 1944
  2⤵
  - Program crash
  PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 5460 -ip 5460
1⤵
PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3628 -ip 3628
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 2f4552ea515dbfcde9035078c603591c07d1431305a7c4fc50e0786d3d075450
MD5 b99d7302ca7741656a2c22e5c8774ad2
SHA1 518ca3bad2e7b64c126cd8d16986f6f528d41bd1
SHA512 9645974aae150b3d65b6b244c0541da6b03460e4c2b79914dcf4a929dfedf135495f59c6480c27022ab28da21927e2ecbe52bd931abeffaa892c226095409ef8
SSDEEP 3072:phnmUgAZMwGwQdxDrNcIBAhnhJiZQR0ysMlpm+Jd:p+GwyIBinhkZNF0p3f
TLSH
T146140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ca18840a0acbc78cafc4b4b6b4c289cef16b1d2f1c6728ce2d4206ad1e14393f
MD5 7bc0f52db6b6964e40aae8780d5a965b
SHA1 f8e94f05de7d1954724908359e82cafc618629e3
SHA512 1c617942f16d5b93fb3e4b99ffa3f636739d6583089a4133e23da3d1f9a274f947654dd57f24d32f6f7f9bc91f0251dbdc469077274d2523cb11c3fdd8fd655d
TLSH
T124C02B085E564200F1D8033C0180310187805100D040CF0509F5060C835B9043420C2A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 dd6df3519eb49fe54b22b2d332a2715a05375aeeabc3c68c3bb2d86c51603d43
MD5 36b0dfbf6748312925a793670eb68036
SHA1 6551ca40e7fe9c13153bffa80b7a7ca22f54377f
SHA512 0b4e15c7883a4acd764a7565d0f6b62eb996c41c6c03c9daa37b3dff1bc313b91830a587817762944ce93dcc19379ca2a75343071e0620c0a62376d0d95f767d
TLSH
T12AC08C1C5EAA4A06F6F8437C02C139039B609111E241CF052AF53A08CA9BB162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 61169938c843116ad4a324498e6b17e42a532cb20378d50dc06a0b4f2ade7c6d
MD5 68dda59a53de2987cd0b92905bef9cea
SHA1 3c02ff24f4628ff2c6109b788639e691e0f016d6
SHA512 85122da31e3b3d311f054b7d43c3cb8440c51b44b4b5887a8f4121b1ab4804a51f02a0592ac0b61472ab5c9e55116f9146cc41c72ed02f86de55faed61d8aa0e
TLSH
T1B8D08C3C6F620337F13AC77A5C2366829EE03718B0808B0D0AE2348C4D29E463DA1E0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 dfa32c8207fb64c34666462f0b09763a973d3b70486175341ff912e6ee5bf23c
MD5 6f03bd92dac1399d0eee4deb59d7eeec
SHA1 e2ff13897b0a677a2f725be6e47326975759d934
SHA512 e917b97ea3e493b3c6329243abbcedba00e794c7aec9f1d5907c7f54d92c5a5460c6a50d1addf0ca640eace630fb57a5319301aae076c5c4b0321f01402e04a7
TLSH
T1F5C08C1C0A610A06F2E883B802D22983CA208120F3819F012AB22A0CCE24F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatebroker32.exe
Size 105KB
SHA256 d0558fbce5c91fa996f2aabf7aacf687fb873f2666a149af7d50ab4196add67c
MD5 10692357d5f73f6a020f76aba563fd4b
SHA1 87c8b47613a9c2f8b3e4845b5dc2204179750bf4
SHA512 9d06ba5f14e9345afb068e617eeea423f9274f572e12987df58366de71550e10d0e72a45ba4eea58da7fdf2740220fe73314f4a59b68b99ad186c40d4135e263
SSDEEP 3072:pMxJ7Rfp8K172YPrN4vzT+PSZpsB+vs+EOK1xc:pMH7cCxP8psB+E92
TLSH
T11BB36C1276D0C8B1E5B6493108E8DDB09E7DFD614E509EAB33D80A3F0F316C1D625AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 57d065880e1e3d8659344e32e3230a57b0b8205787417c8380b42ae29b0d79e9
MD5 d5d54f9d637a66d13e008cfcb6c9472b
SHA1 8e7b6145516114c894dfa68a90c0f2eb3ab9753a
SHA512 a7352f205869fe95bb3a9090a13f057b5782c7128f989dbf7a02799af767647a7fc310d99b3954642b8ba6981322b8d42cc4c6f10ffd896b6fa5adfc9e93d814
SSDEEP 192:xqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:xqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T12642C67B9825842226F1515F7BBF7208E026F2075541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 df71e39edfde7b7fbd6eb641c2e384fa0d083f5a1c216ea019f31e4078653851
MD5 b94646fc0deb30c01adfa75f950ccf98
SHA1 e31bd6a1165dc9a8726322dd8c90e3b934b2690d
SHA512 dfdcc2327f857eed1a8d23e6798b878fd25fca1c35c7bd307500f111fc9f0a521240e57f43cd23a5a3d350feed79c9f7d77dc13023a6abab0d27bf11e242ccfc
SSDEEP 1536:f24HyOTCasJY2asmyvmRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:f1SOTV6TXpWCmAZBtRb1BAwMW
TLSH
T1E024287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download