002c9addade41f5ef6a06607800834a7f95fc045e01b4997e82a510363d40e23

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample261102-apyw7a1x2m
SHA256 002c9addade41f5ef6a06607800834a7f95fc045e01b4997e82a510363d40e23
MD5 6f5ca1f9446d115d94321207e69c15aa
SHA1 62ec07c7744a754acb2a151dbc13136749a7f6be
SHA512 9ac9ffec648cf8900dda87528b4857305e453998d5d5182558c066fe45330864c436ef8b74cae1d197ac9edcd92a47a011cb1a4fa79d4c5d502d5825cf7dd59e
SSDEEP 6144:GjuDOhVLS5nj+CPXIYKAel/DRfkTC3dM7B+mCiziuW1FXEi:GaoVmp+84YKAelbRfky6B+mCciuWXn
TLSH
T17294E31237F84A68F4BB5A305C759F399A3BBC309E30E7AE16502A5D3D31A419D21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4324	microsoftedgeupdate32.exe
3528	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3752	4512	WerFault.exe	85
3464	3528	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3528	eventviewer.exe
3528	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4324	4512	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	86
PID 4512 wrote to memory of 3528	4512	2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_6f5ca1f9446d115d94321207e69c15aa_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 1724
    3⤵
    - Program crash
    PID:3464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1568
  2⤵
  - Program crash
  PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4512 -ip 4512
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 3528 -ip 3528
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 196KB
SHA256 24b0b006f4d04bfe1236c9a1c609a6d3d4b11391c0fe34f813e169ce70e3b378
MD5 0cf0a4327e150bf5053f747ac3115cd7
SHA1 16c30a5c149116f82bd6374a9472dead0f576e86
SHA512 15e3b813cfe77d5fd984864769503f6b8f6feebe7257c683ec254abdea5f8b07fb1ab19d85a598d8d69e3ec54e7e4a5b4fbd16ff42bd18101f7dab354fc7492f
SSDEEP 3072:Lcx8w9wQDlbUnPXc0NjV5Qv/5XJAsvsBv+Y71CiZj:LfiKc09V5G/Hj0BmwZ
TLSH
T160141C286DBBB1619E4A8DE24CD6AE5603FD719F26027F0B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b8f68aca1c959cb7a4b7ad575717cff864f104b7d390cdbe2423e1c73e9b321a
MD5 4d996a1d94a4cfa3eb7c9c7fbb17e40b
SHA1 6028ab9fd41534c9b2e330bae3c6e430af5e1d32
SHA512 00f87a6145c49707f7a0984fdca9f7a41aa1b475b8df36b665272fa4bd140f1a628592e5b4b781ec6f101fba32acd0ec04a5164c869766d15d31adb05fd61fd7
TLSH
T1A1C02B081A420210F18C077C018132019740C540E0408F0905F1060892179043470C3B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 de6395bcab65588554a584ce2c1ee11585040def0a8fbf9b5eeb12128b333078
MD5 1042d70764b2c2d12f55cb6562146056
SHA1 95107055b2e34bf614c0e075673ab8f208b93f3a
SHA512 474c327243ed0d6a5b2bbe7ee971ddec6f781cc5ca5d6efde690464420ee219abd5e1fb5a8c5e7e20427d3061bf3a059c376c1b877d4087af855b2b515f07f3d
TLSH
T1F8C08C2C1AA20A16F2A843BC02C23E03AB21C541F2418F091AF12A08DA96B162878C3A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 6a363a48a306dc74dfcdc077409dc080f7dc1265dca72d31390ddb0bf5bf0c09
MD5 8d0f3002085dca3ce831aadaa4ca5df2
SHA1 a1f9d40fb1ccf3502df23c8346bdf4432f5adf0b
SHA512 1265bf4a6873f36456eae97e53235ebea52df81b0364a3e6386de9e815685ea4ab9ac49941690641a8482317c3d439121c99a5d24612998a7ed741e040423321
TLSH
T1E8D08C212B660326F2B55B3F19AA0A87CE81E102F0928F8E0573224C5C38E110CE1E2E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 6167cebd2c64505812045666eed9edfc0a24c5b1b7ab31b7e9623aee7cd123af
MD5 f089fb63db5e253f97680eeea9fcd017
SHA1 a4af0156adc9bdc2cb5dfa9eb683f711597995e1
SHA512 566f541d4efac3110b6454f23efb1365f13b9c85e9c047a29ddf0545e474a5382b3ec880b8316b56449f1b8047ce477eb73ca98df930e8a0f8ba2ee5609f41ff
TLSH
T16EC09B0C57514255F1CC577912565582C650D510F5D15B1515B50A0C9537F052470D76
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 338bab1420b6b635c80dba3d8dd6b2c4b40d265b18317788677ec847bf084fd0
MD5 a6c6ecc3558ddef4d892d5c49fc0a5f4
SHA1 da653cf1b2b5608e071d4120a81aa9bf1760b978
SHA512 aa6b43f5909f68476f896863709d7e04ee1648925723884ad24c340b8333746d9c1eecbe7cd5f0254d1ffe779a2c6803e98b24d56fa10424f18ac3354602b725
SSDEEP 192:5FDCqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw31:54qQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T17642D67B9821842225F1525F7BBF7208E026F20B9541DCD1BE8C43051F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 207KB
SHA256 74df4d4333e18a70667dae0399c27a2d08db9fe36cb4425f4920cc11905240cc
MD5 894496025e1e3ef68185f275d6788998
SHA1 c96f8c05793b1f49e9ba7a67c5bf381b4b39af55
SHA512 84c4642e7c471a74c8f9adb61fc569373d68497057b3d45bc56783a1cad2303bdbb226d093dc55818778e75bc50f3fa12e85737af7125703337df23598e9e916
SSDEEP 1536:o24HyOTCasJY2asmyvDRU8yhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:o1SOTE6pXpWCmAZBtRb1BAwMW
TLSH
T1E124287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download