d1f70f429bca18a9b9bce0423d7941b722eec79e1e2c6c137b2c3efa1df7bde7

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261029-xtx7saet2v
SHA256 d1f70f429bca18a9b9bce0423d7941b722eec79e1e2c6c137b2c3efa1df7bde7
MD5 c4b4e6f6f9ec49f838d85d120a7aeef1
SHA1 78feea3665e0d840a3e9bad133af3c4d8f9293ac
SHA512 1a733b102e94ff4366eacde1357bcd6b7f63e8e3d118e059292a5d7340cf12ac300db09d7b573d88dd52bfacd3d6b68792bae7de3ff1e472fdad2ca50930d603
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXE3:GaoVmp+84Yb4lssmroCkiuWXm
TLSH
T156A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4720	microsoftedgeupdatecomregistershell6432.exe
4172	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5440	4172	WerFault.exe	90
5528	2500	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	eventviewer.exe
4172	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4720	2500	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89
PID 2500 wrote to memory of 4172	2500	2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_c4b4e6f6f9ec49f838d85d120a7aeef1_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 1604
    3⤵
    - Program crash
    PID:5440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 1512
  2⤵
  - Program crash
  PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4172 -ip 4172
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2500 -ip 2500
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 d8232b54382656c4c8822844777b86bd5cb6293c2991afc58272dcda11315f2a
MD5 2793740a16b6f30585f6cd66b1132afa
SHA1 912bdff567ee91e1b41eb3a0e2d2c73dafd983d8
SHA512 f17e11185ed88f8bcd9feaaf8a028a47e52f9b4dce447a16d14ff8eb65df9ed51dbdfdf3b592017f2d9c0a8d1cdc9445bd8695808a87d771f6083e2673da76ae
SSDEEP 3072:1mUiAZowGwQ2xDCNh+B4fRqJRF57E+sv4pv+lF:UM/i+BmRq/FO5gpmf
TLSH
T10B140C282DBBB1619E0ACDE24CD6AE5646FD719F21027F1B4EF4AED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 77b80c519bd9c361d09f07b974418c41a904f79d3bb3c8404fc7ab0d53673e87
MD5 64404443ac964eedd6b8325de40bc506
SHA1 7ee8e186a9c81ff8fcd0ac7bb90286ad622f081e
SHA512 064fa544ed5987017c174f025910b81c58fc1be7eaa9d1ccafb50686598aa4f3453cb89a2fbe3a41cce798c50ab62b2c15fc652de31b157a091d8f7aaeae6213
TLSH
T198C08C1C1AA24A06F2A8437C02C239039B208201F2418F161AF22A08CA9AF162878C2B
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 40a105ed6e6556b448ab76062a8c59bfd04bb4a46b57eb991eea24b410275790
MD5 e53dcf83b139fbc03f47085e08e88554
SHA1 cc27c799f03444f5695b6d041808d102b489fc7c
SHA512 f9f6de0825992302fa30b3df0c21e021b96517e95b279f9a109f661b9dbe4ab580654f16450424619738daaa365a6e3aa694d7631b9b3dcc9a8bfe03689c8021
TLSH
T1D2D08C1ADB69976AF13382B6185A0691BAE08602F091AF4E0962120C982EB020EE1D0F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 975b738e1b5cb3a95c97e23f02900874b6413fecbed18bbe8e3bd6a182e104b4
MD5 3d8d3f26e67e2784e1298c7b1ad44298
SHA1 7d259a339da9981d5de4596c6fd58d1de35d4825
SHA512 9f5d7824977bf4912bd39b5730afd6b17d35df65cc38d97b50b1d39fcab81f80504aec24f9f0fe6c5a20765b2870486e7360dc0e7e7723bbc095d2f365e929a9
TLSH
T123C08C1C06618A06F2E883B812C22D838A208211F3819F0127B16A08CD64F222834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 e172b93e4360ef1ba8b3152c3465d89b516ea94cedd923ed215ad5d8cd9482c7
MD5 9027170f6964ecc2fa6a052bc23d35d8
SHA1 4a99cf8b657c05df88932e6698f433d5d0356a06
SHA512 85bc9715924b34e6ec5c43928fdff0ec8517c1f29dfa5de975da388fe714ae540f06aefd4137ff4d1457601845a577652749747673cb8626a9a2653f80983a10
SSDEEP 768:RqQmVAz24xtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7Y:/24HyOTCasJY2aso
TLSH
T1C0D22B7B8724087565E3074A6FBF7584B855A08BF102D4F4BAAF26052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 e5d2aa0011ff6c0b86aa90b397f39e4905c540dfe1c14e0ef2efb66078dfc6d1
MD5 b63ffb9e534aa82eb72045f7efb29908
SHA1 ee749c8cfa6afa6de9da1a2c3d654e50f7498d60
SHA512 167da204da997a0a130a991d5fcba6b8de92d32577f34ff8bc157b22cb20e82dc75ed09d3c1d004dcfd7fcec9376149ec0a4c1b179be5068915b80a3461aa218
SSDEEP 1536:/24HyOTCasJY2asmyvRRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTy6TXpWCmAZBtRb1BAwMW
TLSH
T1B324287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download