0b3028b186e93735064c6bfb0876b87817635aaba6131ef914de1416f1c39530

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample261030-ma8t3aeb79
SHA256 0b3028b186e93735064c6bfb0876b87817635aaba6131ef914de1416f1c39530
MD5 0fd2abb415bce4b34df8860d0946cf32
SHA1 514721314e89784660c070cd699497bc48ba2a63
SHA512 fb47f2a44906c66f2756f895738c12d9750201b31e29a8d12f5578eff6401036a22d4ce519c0b7ac5c6840ca32ab13551bbde517a5a0dfbe5a26238a1fdcd4eb
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXEA:GaoVmp+84YgcP/aK2vB+WiuWX9
TLSH
T15884381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
620	googleupdate32.exe
3256	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2772	5320	WerFault.exe	87
4824	3256	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3256	eventviewer.exe
3256	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 620	5320	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89
PID 5320 wrote to memory of 3256	5320	2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_0fd2abb415bce4b34df8860d0946cf32_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:620
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1604
    3⤵
    - Program crash
    PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5320 -s 1312
  2⤵
  - Program crash
  PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3256 -ip 3256
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5320 -ip 5320
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 33227b6c7b2b5c7c06e0846b19f5dcaa98051b3af7fe088c985d2a6e5e5efe67
MD5 5483d08ff21153361bf0e6fed2847ec0
SHA1 421e19d147a57019102f0a64f7a71faba98a417f
SHA512 0ec6afe7ccc36a9105bd7efbc77b9a41721f4be454fba2e192889ead6ede17446dc6f6bb6193f3809e075fe442f792882bf11610dd8e7e412a91e6f721d66099
SSDEEP 3072:bmUtjZowGwQrxDCNLGB4fRqJRF57ERsvsEv+81bR:xFKGGBmRq/FOO0Em8R
TLSH
T1E0140C286DBBB1619E0ACDE24CD6AE5642FD719F21027F1B4EF4AED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 174ff9bbf3418d9d793f34f5e49e04124bc64a0723e9ec9da5f26d3f41f9901c
MD5 b1a8ca413a80837c945d2af38e73b224
SHA1 3f10534b23250ebac10810b34ca7080f21f09397
SHA512 3777112f84e543e1ea8c944d82a9058e94b269b485bd223afae615f2ab5480d37dde06a2f4e6a3cade55a0d0dbd9082ea4aba9e858136fc0e4a1e965071523bb
TLSH
T1E7C08C2C5EA20A06F2A843BC02C13A139B608141E2458F051AF17A08C996B162D38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 d6144be213fe0d1e6d9f1836de33f5c452dec072cbada4ad3c31693532fab1ba
MD5 987eebe3f8db108d9b864a1341099dce
SHA1 843919f9b26c45f61977d360bad64a24b525af5a
SHA512 08fa95da07961aba5eb3d641b6a1ff66a2130e8fc493e89a4ae4183d4bc3bf3d53c0330913321bff2dd7017f31ec1a625aa7b93cf221cb9a168bb13f24c3bc43
TLSH
T103E05E627BE45615E9730B3CB972A2854977BA6BA901CA8D0239008D5C36F20C83371A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 ebd9de44ce38c456ae00190ccb10bd6d251fe124d81f6ed00778e7b3319f657b
MD5 825f814d572ce2fdf1851af41aafaf41
SHA1 5b25c5fa78d9d6d04f007d812efc4f895a0964b9
SHA512 3f4a5527b34729a6404862380a4953a4b487808cad053be2ca2a840547b87878153877e491e0b8731c065e974f54905264a4daf215719392c721341273d40451
TLSH
T159D022181BDB022AF2C406B9C2F009821AA87443F6598B4E8B365E1ECC2FF220C22D1C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3380c7491477522aed72d9fdb629afabbddae6896a0a049c1c75050a411ed99a
MD5 8c5db1d620f12415fd7fa8b9122414f6
SHA1 9ec9eb7e85f03f7f573f694b94d4df987a33e292
SHA512 6dcdd21a68ee3ca954211b42e238064aee5c656d02e2a9d633a5cebce8b6546eec29873bbad2790d4cfcc6237a63504a5ab7e004e1359524d91b0eec50d1f6ad
TLSH
T137C08C1C46610617F6A883B802C23A838A748120F3829F0127B16A18DD24F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 70f4a7dde7f302906791424e8ad0f8d8dfabd68114a3d08a4303406f27d9868a
MD5 bee9c8ecac4195632ce05e9330dee24d
SHA1 a10c4a93deadcd7a827a9098c1c429502665a6ac
SHA512 d7e5f144c3b0c3e8e4c217bcab0cc848f1f3932c56b67f4211bd1f24e0254d22eda37cda74509bf8d38895d728b23c856b619a92bdcc14fd7e4d0e9bc4b9313a
SSDEEP 192:yaqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:yaqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T1B342D77B9826842225F1515F7BBF7208E026F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 3fc5ce2f77d54763465a05112d757640c4d525cb807b4d88e6f862511ded1a72
MD5 b9bac69fd287b52befa7414f07962d6d
SHA1 4ac2a118d3723400c87497b8dd1b477598ec8419
SHA512 04c8d9628986fc37004f9f1600cfe31e68f0b1d74594380a9e9a82c1677f2600d182c3bfb581cfd0d483af832543b913ba02c92b06e24f04642d9bd4b77a256f
SSDEEP 1536:/24HyOTCasJY2asmyvRRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTy6TXpWCmAZBtRb1BAwMW
TLSH
T19E24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download