847de161bca0c95b081b9bd36939ecb09ec3e27f8cad6b5c90e37cb154dd8b4f

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample261102-dk3alass6m
SHA256 847de161bca0c95b081b9bd36939ecb09ec3e27f8cad6b5c90e37cb154dd8b4f
MD5 f4798e145ef4b6a8d426b25512584f62
SHA1 73f44cea0dbc87d9da33476db76dd3367f4d8ccc
SHA512 b4dc04ffc551ed1f5695fd225f62cba83ed71eb0dfa937c937f4b8f9bc7dc7a7ceadeb0a25f3c4ede4151b2599f1c262a93ed010a21bccbbbd1668988db4ee83
SSDEEP 6144:GjuDOhVLS5nj+CPXIYjZNr2fYLRzB+Aw4RiuW1FXE1:GaoVmp+84YjbrNRzB+N4RiuWXg
TLSH
T159747C1235D08FB1E1AF04314DA19A759A7BFC300E209BD76394BF6D3E31A81DA26767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4688	microsoftedgeupdateondemand32.exe
4500	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5456	4500	WerFault.exe	92
5232	4948	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4500	eventviewer.exe
4500	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4688	4948	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	91
PID 4948 wrote to memory of 4500	4948	2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f4798e145ef4b6a8d426b25512584f62_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdateondemand32.exe
  "microsoftedgeupdateondemand32.exe "
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1608
    3⤵
    - Program crash
    PID:5456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1476
  2⤵
  - Program crash
  PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4948 -ip 4948
1⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4500 -ip 4500
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 197KB
SHA256 365af386f88e42d196685d955782592e509d03a39bc0361aa4aa7469b1518273
MD5 bfc467294b968667873805667cff035b
SHA1 4faeb3d5b9810119759e03b46b98f9fa82c30afb
SHA512 e358f6db8801f355d2515a14189724fd0635dfbd6ca3704be0e1a256a00d5ff6e71def6b16c437f9fb28134a0f6e152d02e2cfa051dc6cba66f539235efb0bd2
SSDEEP 3072:tcx8w9wQZlbWvPXc0NjV5Q+/5xJAsvsBv+w71CiByG:tfG+c09V5B/tj0Bm4L
TLSH
T107141D286DBBB1619E4A8DE24CD6AE5643FD719F26027F0B4EF06ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 632afec1368a71d147e7aee080e389139756fec59db3c702d2cbbf0ca1b36f98
MD5 b70b8058e1f1c6987209bc31f7b4fc0d
SHA1 64a17a1dc7cf94c6819be5071f3d42b78e64077c
SHA512 8159be1b670dda51e6575af8ccb71a8954f672845d56de44f2da0696ac9a7688d459d82117696cd0b02e673a22f0d8dd996394f123867ce77b2b9059996c809a
TLSH
T195C08C1C1AA20A07F2A8437C02C17A439B208141F241CF091AF52A08CA97B16A838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 be3c40fd254e82c4beb82b1ad99585b7b264e5998678a96fffe861b47f4d23c9
MD5 fcc52dda1bf50b5a10be36f468be36a7
SHA1 fae382c0a03993723fb6c8f825c5087670a4a974
SHA512 109691d02f52636018b9d5500035c7ed9974d8e520da26737afe1508b9a5af29a7f2e9afc04fe1963169805e39c70a6e158a370d9790ec2c1ad362419e4134e2
TLSH
T153E05E627BE41215E5730B3CB9B2A1864A77B6677911CACD0234004D5C35F30C833B2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 ab8653280850e06584923d981077406e1adb1934b2942ca8baca9bdf3e57a9cd
MD5 9b0eff3d0a66af6bf4978be3293f8c28
SHA1 aba18938b0d95ffd6d47db3d25f1bdf47a0e2e70
SHA512 4e88ee7abd8d536162990d424b9c8199d40ccef73d5002b8f5951303716dcbaffc7cc53b6bc7a3349519d969bb5be81f81001938d3d8d29d21c99081c266f758
TLSH
T17AD012381B65023BF6684275986045D2FA50E929B7938B052B6F960DA419D460CB2C5D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 f208c70e1df112bc226723fae6cdd32c0325ec4bbed244743e3821c3c124f0cf
MD5 edc7aaedd80fa051a46444f275a185d9
SHA1 cca2e19af6b72ae2baf1fce73ba8b6bfa8bfdad9
SHA512 7760083e48d21f2a97602fbdca605fcda811b8d218432613dd5b2a823a7ec6f2e648d489b84ba831ff2365e00e2a24997ea51be7dbb653fef6c96b971ae7c3f4
TLSH
T12DC08C2C06650606F2A883B802C229838A208220F3819F0126B12A1CCD24F122834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdateondemand32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdateondemand32.exe
Size 98KB
SHA256 5b4986f62b62e1251a01bd05ffaa010480953ab32815298c6c38db86f004f005
MD5 6bd2649fbd09aa54b83ec372c3eca318
SHA1 aa15234f06c316efc7f2eb679c12cec4a8e69794
SHA512 5bf5dc58357e154dd003828999a0fb0b03e0e67e2799827acb5a191f7a9ddabed16afaa7eeec8c69b8ff997855949868f2d0244db8d4a869ce8e592b9533afd9
SSDEEP 3072:eZU+l/8xoAm2+YDfYz8GrRfaivqozB+IvcZ4wi:IZNr2fYLRzB+Aw4/
TLSH
T1ADA35B1375D088A1E5B21C3049E0ED719D7FF9620B509EAB338467BD0F326D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 38ba0b267441ecc78ccd7d6c221fcae4d90922fe139bf326607408a9ebc40387
MD5 55d1a56991bc80e7722ae66842d11ebe
SHA1 6d4dc5fa07ab83ab7a88024f725344ef67e8dd04
SHA512 bdfec55c818f02fefcd29efd81c9163087027a3d2e1c786b40ee7a4afe7d8e8568a4861fc2e10ee04a707d6b997566f1a5c6133eedcdd905c4b74431185c0f8d
SSDEEP 768:tqQmVAz24xtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7Y:L24HyOTCasJY2aso
TLSH
T16DD22B7B8724087565E3034A6FBF7584B855A08BF502D4F4BAAF26052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 207KB
SHA256 a6eee050fdec392b7622a948eb23761117e052cc7470a5c93f652230eba7f4b7
MD5 1b473fc13da013ea78eb439aa9c44f82
SHA1 5beafe1db010354ea42fc5c66fd60637bce3469e
SHA512 84a4809bf34ecbb32187dec6820fce94a86cacf5cd631297e44e0c99acab7b93764d2e301c1265f37b4eb596f4ece1728ff588911c96136e34d95d79698824c7
SSDEEP 1536:L24HyOTCasJY2asmyvDRU8yhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:L1SOTE6pXpWCmAZBtRb1BAwMW
TLSH
T14E24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download