4497ad69c3db8089e9e371a67686d2723fc6aa24c85d9e652e2ee7d70eca7bb3

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample261027-ryyffssv3l
SHA256 4497ad69c3db8089e9e371a67686d2723fc6aa24c85d9e652e2ee7d70eca7bb3
MD5 726fc73a8b11cd613487c49ee33f326f
SHA1 5db0103f06da4941d3b0d9f393dbaf76d0cb51a2
SHA512 d2b0faf28b669b5a688cf1d80e4789aabfce9c9e9c1d09aaa0a022614e1ba5b8a09198b2625296c5cf5ade0ec43d1229174273836cef85c52e8924afa672fe93
SSDEEP 12288:GaoVrwc4Y7i3drBRy9hdFIdhoyYTiuWXP:GDVrnPi/RyhdshPmiuWXP
TLSH
T1EE94AE1672E044F5E1764031CC625E39E773FC700B319AAF4364AB6A9E326909D3BB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3216	googleupdatecomregistershell6432.exe
4080	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1420	4080	WerFault.exe	90
4572	5480	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4080	eventviewer.exe
4080	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 3216	5480	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89
PID 5480 wrote to memory of 4080	5480	2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_726fc73a8b11cd613487c49ee33f326f_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1876
    3⤵
    - Program crash
    PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 1760
  2⤵
  - Program crash
  PID:4572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4080 -ip 4080
1⤵
PID:2760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5480 -ip 5480
1⤵
PID:4324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 eb721bcccc4b13bd2468a8949f4bf315f3dbd37df151770d2c358b9ad3d7a1f7
MD5 28489f37f912c615a1f7c40024f08472
SHA1 9ffe3fe6defc21026d63d1b530a79c9a5461b008
SHA512 e93e48345209b4b581b5811fd7dcd145f50e3303c557b2f98869ba710934fd52f04108e6b0f01a83f33c441080757bd8060826ed4fe41e42206c78bc071ac1da
SSDEEP 3072:QhnmUpAZMwGwQnxDrN5IBAfnhJRZQRhPsMlpm+MD:Q7GknIB+nh/Zak0p3c
TLSH
T19E140C282DBBB1619E0ACDE24CD6AE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6532497d19354a4b6e6b53a482d6c6ab5838573e73b6c699ff9d66b55aa30abe
MD5 a0067ab66fbc9c294e7a158851edc167
SHA1 c3e1f4b601e932f3c6e52d16132974a0f9969d25
SHA512 07963083c0deeefe4b1212ac75be96afb0a37beb7fd1fc85e26eb14221018eca457ec67f62959b55de18436506d6cb24a3b77bd0ce36285dfda11405a8d016e8
TLSH
T12DC08C1C1AA60A0AF2E8437C52D239039B208101E285CF052AF53A08CD9AB162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 a565b80b345a0b0b8d37f390d2e112b853a1f0e0249388cabc9b1a9369d81d39
MD5 2737ae187ddaf364f347ef9541962a9c
SHA1 6e09226283df3950034e79486ccdc3d75c6af750
SHA512 c0fc528f11f4313be6cf2f790a9e22fccfcbd1abeb7f4d6ad2a097df683b725838a35edd18f009e60841371f4ce7a85ea0c4c09ea11a23c816988ea64925afb4
TLSH
T1F8D0C92E1F104227F158CE7A96D24D425EE42159B5835B161BF42E2D982EE42287582D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 493f444b24653777207d0bad6fe360e950e81993db7c96d777b719647bd1f50b
MD5 67c4799e182f2c7683e6810742a37e7d
SHA1 25c1c419ee4b4afc8c97e2088d34e0db5ccea11b
SHA512 df17143b7bb1cde0ed56abc2e58c2b48d63f59c164b820ac82595281a3eb69e516eca87d308db433948b851dd760fcb64b055efe9cd315905bfa97c239645859
TLSH
T1FDC08C1C0A614606F2A883BD12D229839A208111F3829F0126B67A08CD28F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 172KB
SHA256 28236a9f6b1736619f6622dcf60af704063f8661ea402c4f2543dfc5b6eb2d8d
MD5 41e73a621d25abf2e5bbcd0b51535254
SHA1 e920d66f43005295a4647253999159e4b454706d
SHA512 f01dbb3bbb18061642fed4b0fa99bc227f09ff776efa923428e58fa7eaf50c9ae26f425d60656a0c3d6fd549bb7199fef058a1902aaf72537e1dfce87605e44a
SSDEEP 768:2qQmVAz24xtyOdIzIYu6MlBAqe9nQkZn3wklW/4cWSQ6U+TzAoJVJ6PnOhpshXxa:c24HyO2QkM4cWSprqPnOEDkf
TLSH
T13A044B7523A045E7E0C383B8BAA5750DAA31E257F552D4C0F79E12412F43EA3CD7B9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 de0e21e9a26c7bdad1287fd248092d8960d27f6879c84ac7e2efa75a1ee12b10
MD5 fdf59375a8727bf643c717f351abe16c
SHA1 6a6a2badb21920cc130c8080421b7c8f8d91e948
SHA512 09d9fac7f8d9d7e56eab2f3c1b3b3559c55bd96036f2602d2b797bd01ae915909caa96104d24d22d6c63a156502f167e1b4a1d201da2d7761e7992da81adef7f
SSDEEP 1536:c24HyOTCasJY2assQkM4cWSprqPnOEDkLZBtMascblXNjW1Q7AwMW:c1SOTRCmAZBtRb1BAwMW
TLSH
T1E6242A7553B009BAD0C34378BBA57659BE65D08BF503D4E8F7AE16012F83DB28837998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download