d1f70f429bca18a9b9bce0423d7941b722eec79e1e2c6c137b2c3efa1df7bde7

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261029-xtx7saet2v
SHA256 d1f70f429bca18a9b9bce0423d7941b722eec79e1e2c6c137b2c3efa1df7bde7
MD5 c4b4e6f6f9ec49f838d85d120a7aeef1
SHA1 78feea3665e0d840a3e9bad133af3c4d8f9293ac
SHA512 1a733b102e94ff4366eacde1357bcd6b7f63e8e3d118e059292a5d7340cf12ac300db09d7b573d88dd52bfacd3d6b68792bae7de3ff1e472fdad2ca50930d603
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXE3:GaoVmp+84Yb4lssmroCkiuWXm
TLSH
T156A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1176	microsoftedgeupdatecomregistershell6432.exe
564	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2764	564	WerFault.exe	86
3812	4580	WerFault.exe	84

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	eventviewer.exe
564	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 1176	4580	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	85
PID 4580 wrote to memory of 564	4580	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:564
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 1288
    3⤵
    - Program crash
    PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1312
  2⤵
  - Program crash
  PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 564 -ip 564
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4580 -ip 4580
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 d8232b54382656c4c8822844777b86bd5cb6293c2991afc58272dcda11315f2a
MD5 2793740a16b6f30585f6cd66b1132afa
SHA1 912bdff567ee91e1b41eb3a0e2d2c73dafd983d8
SHA512 f17e11185ed88f8bcd9feaaf8a028a47e52f9b4dce447a16d14ff8eb65df9ed51dbdfdf3b592017f2d9c0a8d1cdc9445bd8695808a87d771f6083e2673da76ae
SSDEEP 3072:1mUiAZowGwQ2xDCNh+B4fRqJRF57E+sv4pv+lF:UM/i+BmRq/FO5gpmf
TLSH
T10B140C282DBBB1619E0ACDE24CD6AE5646FD719F21027F1B4EF4AED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a8d4d0a617e807d88ba441d2f4e18591feb9d2187b7e9041b99a3fa03697c3f1
MD5 7aca7c973e57b18d2d71be3d8ad604ee
SHA1 255c6cf8ba85832a3bb8fc032997c40c0a5c5799
SHA512 3edde6b233153f930167a8e30393d499ffe627a3d431261b672cd96cf8c12254d047477b37cc8613e1469c82adb15d69c6b73ee1820f0ee131faab0ab345aa5d
TLSH
T141C02B081A424300F188033C119271018B504200E0408F0505F5060881579043428D3F
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 62ef25188ab3afa73149750f5324f047183bf3687bef5ecddc742c4203e92469
MD5 ce2d583b798a3480207c0f14b271e542
SHA1 379e201b3333a50bbf7f7a12e99ce2ff45c2a2a2
SHA512 0ed287eb8d6728a0880bba120ef255887ecfac80e98a568d4dfb4ce15110550d19ef5472224fe9c6dd02a5c544b8638a9ccaa93823677916074570a488e1d848
TLSH
T131C08C1C1AA24A06F6A8437C12D27D039B208201F3418F052AF52A08C996B26383CC3E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 12684e122ed3a62777c3c1f35801023d362fad1e70bfc9f7f99dbd4cceee867d
MD5 2921d83ce2c52ffe9ae56160f4f0849c
SHA1 f76e2f2df79b74f818fe23a8c70e9bc9b208d77e
SHA512 9c4f7da398de21b3ae19f08d767f8270e84153f69c69d91361fe86de4a33d3dd829aeea26a71e3e8eacaed0402e8db9c8eb32aa0ba4a8877e785353877ca0fb8
TLSH
T106D022190799A71AF52182B6089B0AA07BE08602F081AF0D2F62360C843DF011D90C0E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 ce607dd662097f95dd35923411093176756d7242edff02052238fb7dc73124fc
MD5 81cf9617707ba1812d7cba4bb97a9d33
SHA1 7d63350d5f42c0b356547ff5ade782d17d9e4f24
SHA512 6ecb42428486ce98bcda5f4d9fde1a9eec7b1e87e03c76771e9696dc6a84bf81e33d982bb388246b08e57e39b69a104e5a7d4cb846d446722aa1af80026cae85
TLSH
T10DC0920E57528215F28897BD129266828AA49620F591AB5616B60A0C9A3BF056870D6A
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 b914bf865a5fdef490dc431fb624e283b5756d72002b345b84db05cf8b89b720
MD5 bb19ffa85e7408d07909d2d99960c727
SHA1 df4b1508d47196aa0c837403c9e0e6ca438b6a48
SHA512 e7d1df95f8268d07ea401b5144e9034fc318fb68148c42e25795758777943cd6dc32dfb51ba1cb159f16888f9c25812e3837566432d0927f248c38f80cf74893
SSDEEP 192:RqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:RqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T1D142C67B9825842225F1515F7BBFB208E026F2079541DCD1BE8C43051F927ABE5B2E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 e5d2aa0011ff6c0b86aa90b397f39e4905c540dfe1c14e0ef2efb66078dfc6d1
MD5 b63ffb9e534aa82eb72045f7efb29908
SHA1 ee749c8cfa6afa6de9da1a2c3d654e50f7498d60
SHA512 167da204da997a0a130a991d5fcba6b8de92d32577f34ff8bc157b22cb20e82dc75ed09d3c1d004dcfd7fcec9376149ec0a4c1b179be5068915b80a3461aa218
SSDEEP 1536:/24HyOTCasJY2asmyvRRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTy6TXpWCmAZBtRb1BAwMW
TLSH
T1B324287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download