fb71df283178b4037bee2966c54cee67d880a7dd932b716a22c2395cd42d4cbd

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample261027-p7mn7sd14m
SHA256 fb71df283178b4037bee2966c54cee67d880a7dd932b716a22c2395cd42d4cbd
MD5 850d50c19cee4ef652822ace87185634
SHA1 2274afa83abcd50b89d1c1f09df593fcae58c16e
SHA512 ad19d311aa2c6dbef1a4dc7d86769a47dad80d0a9fad40fa10217721f84d844b97292f8e92a25e3a287fc4930dd7a42f4a5add7ed57b7f5d1c74c55abd24825c
SSDEEP 6144:GjuDOhVLS5nj+CUXIYd8Ael/DRfkTC3dM7B+mCiziuW1FXEr:GaoVmp+j4Yd8AelbRfky6B+mCciuWXi
TLSH
T10E94F41237F84969F4F35A305C319F399A3AFC309E31E6AE17542A9D2C31A819D21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2436	microsoftedgeupdate32.exe
4608	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2544	4608	WerFault.exe	89
5648	6124	WerFault.exe	86

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	eventviewer.exe
4608	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 2436	6124	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88
PID 6124 wrote to memory of 4608	6124	2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_850d50c19cee4ef652822ace87185634_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 1856
    3⤵
    - Program crash
    PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1492
  2⤵
  - Program crash
  PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4608 -ip 4608
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6124 -ip 6124
1⤵
PID:6064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 09929eac0e12db0833efdbe7891c2efb2a2dcecb5830d29d547de487c4e9a992
MD5 cb90b30b92450ee4a74f4192968e5678
SHA1 28f6d6b2590174dd98f12c10daf7e3501ef1b237
SHA512 eb6c316faa2919886ca88ee2c68cbd9a803a57a838df8865218a8328eee1274db2816ecc5e9a3979b778de4e4b89d75c6356dfabcba59173e1b119c442a1985e
SSDEEP 3072:chnmUoAZMwGwQnxDrN5IBAfnhJRZQRhysMlpm+MA:c+GknIB+nh/ZaF0p39
TLSH
T1DF140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 2783ddfca0b8ef0e4b4dfc1a4b56cf9132d5efee598ccca0eeefffcec5a9c3a2
MD5 e825a2632d6ca69ce49cfcf3a3e3c78e
SHA1 47fad1dcf252579d6f6572cb8f58378a35b69579
SHA512 edee0eb75e3e891a51a5b4e23e63c4c290bbeeba21ac762235bb98144f33af7eb1c0cc9c51683588257f6c0fa1321034bc31be1133d96571ce1d6cfcf6e8834b
TLSH
T198C08C2C1AA20A06F2E8437C12C139039B20C141E2418F051AF12A48CD96B162878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 09eebf6b75dcceadc53ecda7422a701ef06ede5a63fbc752047c4ba53cadb107
MD5 a36512b1d3d4219a05f28b68fccc3e0d
SHA1 2e3af10f8346d8aea5413c09dcbe6b10da28cc4d
SHA512 1f4cbe0c41efb95291c1fee4009a970f74cae5984b8d051e55492d1a9bb0414e966b24e98199728deee21eb423aaaa6d9144a350f0432121449bd3f4c65598ed
TLSH
T1CBD012353BE10336F429827A88B00A82DAC82210B1818B0D01E51A49D82B9021D6A90E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 774f09d7840f297b5afc4a689551722971ca67024b87ce62c84ed1a59f18d628
MD5 76b21c4e3727c53b90becba816150c6a
SHA1 e17f985033546d4c040c08058fa8ae225e508a92
SHA512 f86567de16694cf6df160579dc1661e9edbb91f03c80fe010892ed8941deec2f7d9073e3fb98035ec62b2507db88b8063a98ab4d633e9254ffbec363599d556f
TLSH
T111C08C1C06A1060AF2A883B802C2AD839A208210F3819F0126B13A0CCD24F222874C2A
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 66a19e4ce34ba8634ddbdacb701e7aae8253aaf91a0e64cfa93234dd84fced50
MD5 97839ce011c8c0dc0ccc53299c910ba7
SHA1 e9410452281c1717f6fd2d9a33d3b71c38a2be0d
SHA512 d3c4263f10ec6f646e01b04da9a5bb5a079458f38664fdcb43bfbdf287326e0a73f6b90f9015777f66f793ebb4a9cfa5abb4520eb80d8b0f5b6dc6c792b4c6a4
SSDEEP 192:RqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:RqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T1E742C67B9822842225F1515F7BBF7208E066F2079541DCD1BE8C43052F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 4b175c49580c924b111a368d2ed6f610cb50b846707490cfb9549f3ec9cd8175
MD5 a43c0fe69d968ae9395374745d5a3694
SHA1 379195bdfc10cb2492394622300c735b1ee4ad6b
SHA512 60b244aa2e20ec0d05f2f4c35dc99a38a063d1d65e855d11e8cdf547574347699b04a27c7eb8ece0e1c224b83a0b0f19c5b50295d52c5902bec23175f4b107f8
SSDEEP 1536:/24HyOTCasJY2asmyvORUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTh6TXpWCmAZBtRb1BAwMW
TLSH
T17F24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download