f41cc7c3348add2b2172be234f5554ee06ace128116624d338a22b39b8869de1

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261102-c9sa9ass2m
SHA256 f41cc7c3348add2b2172be234f5554ee06ace128116624d338a22b39b8869de1
MD5 f6b8ad013dfa1bb9136cc9cf3e4965db
SHA1 99f0106e45b79c6e1fd9d48312ff2779014f9ec0
SHA512 577c06ea3d56755c34a3c7653da57e520afb9dcd6eb6aeda130c0fdd85c70359f3dda58df84dbe1bf97e8008d90ef477ee5af0a123a80479c6e462126c3bfa80
SSDEEP 6144:GjuDOhVLS5nj+CPXIYV540UVwleMITTmNv1ohWsqkiuW1FXEc:GaoVmp+84Yb4lssmroCkiuWX1
TLSH
T1C3A45B1535E40AF2D1AF80748AE14A66E277FC711F204FEB43905F597E32A905D2BB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4684	microsoftedgeupdatecomregistershell6432.exe
5080	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4424	4648	WerFault.exe	87
2132	5080	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	eventviewer.exe
5080	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4684	4648	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89
PID 4648 wrote to memory of 5080	4648	2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f6b8ad013dfa1bb9136cc9cf3e4965db_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1884
    3⤵
    - Program crash
    PID:2132
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1476
  2⤵
  - Program crash
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4648 -ip 4648
1⤵
PID:2836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5080 -ip 5080
1⤵
PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 197KB
SHA256 365af386f88e42d196685d955782592e509d03a39bc0361aa4aa7469b1518273
MD5 bfc467294b968667873805667cff035b
SHA1 4faeb3d5b9810119759e03b46b98f9fa82c30afb
SHA512 e358f6db8801f355d2515a14189724fd0635dfbd6ca3704be0e1a256a00d5ff6e71def6b16c437f9fb28134a0f6e152d02e2cfa051dc6cba66f539235efb0bd2
SSDEEP 3072:tcx8w9wQZlbWvPXc0NjV5Q+/5xJAsvsBv+w71CiByG:tfG+c09V5B/tj0Bm4L
TLSH
T107141D286DBBB1619E4A8DE24CD6AE5643FD719F26027F0B4EF06ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a564bba478afc1bb0c42979579d4b56d4cfb604ebb6ce5786bd4c16a3378f5af
MD5 e6d609833301d5ac80695f1e23f0045a
SHA1 4769b5fa6f654c8ed2bab7e723eecb6156240157
SHA512 932869d82bf032e7a5d04f91b6103f95a648216cbb334a929c20a2207333be31b3568108466ea755073d1b5100bff9899db9cd2649dd1b61897ce488d090f6a5
TLSH
T18AC08C1C2AA24A06F2A843BC42C139039B208201F3498F061AF12A08D997B1A2838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 5fe27c918292fe4c1a2bea7750d7bbcb8ee2f50b323dd87001890be350bb45e6
MD5 b32ac7851102e0704347044843832ee4
SHA1 33478d476b750fe4becaec22676a538319781975
SHA512 154fc16f09131da080e978807547fbbc2dc47d77294bc421945a4e10ac5a0ba4c07657bd9b61898ec7004fe24839646b72aac2c97e81c08c67fe30d428d1894f
TLSH
T1B6D022341B21023BF5284275C8600192FA50E929B3928F052BAF820DA419D020CB2C0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 c20fd1fa8b7746cd63faf17970e52731e39a5771e0502008d7b5f48b8cf46d7f
MD5 d8290f9533c996e289b012ccc77faf39
SHA1 10d312c3f9abdea6f546c4088b85610a3546560e
SHA512 147eb743e422832067afcbbd6297d0522933b742f8f946ca5329e9156e1f9eae8113549a1bd969488726df4d03966a6762c67fdfa7533fd231a88be2671f2ae4
TLSH
T126C08C1C16610607F2A883B812C629879A208110F381AF0226B52A08CD24F162874C29
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 6128c27478d3cfc493eb92830459d309bdb29b63f78a02f735be2ab20ca609c7
MD5 8721a6860ebe5e6732316170cce83ef4
SHA1 def260997a071b2aa1360eb154b39a43058a03dd
SHA512 89762758a9dae3c9d60b513a9510703010c4afce3ac1539ae4d41098b3a4e9f4dec34a9946f709c1cf66d5e43cffe6685352961e2c2bc64a20fb49695c2ebfbe
SSDEEP 192:tqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:tqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T12F42C67B9821842225F1525F7BBF7208E066F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 207KB
SHA256 a6eee050fdec392b7622a948eb23761117e052cc7470a5c93f652230eba7f4b7
MD5 1b473fc13da013ea78eb439aa9c44f82
SHA1 5beafe1db010354ea42fc5c66fd60637bce3469e
SHA512 84a4809bf34ecbb32187dec6820fce94a86cacf5cd631297e44e0c99acab7b93764d2e301c1265f37b4eb596f4ece1728ff588911c96136e34d95d79698824c7
SSDEEP 1536:L24HyOTCasJY2asmyvDRU8yhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:L1SOTE6pXpWCmAZBtRb1BAwMW
TLSH
T14E24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download