85775eb717e8c3ef14675bacabfe77bdb9da8fec832b18552c0b3aea1daf0497

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Size 395KB
Sample261102-tls2babt7y
SHA256 85775eb717e8c3ef14675bacabfe77bdb9da8fec832b18552c0b3aea1daf0497
MD5 84d9bcb82141303da585741aa8c27a8f
SHA1 0274a837b30d3c1514976859eab0f39c2644688d
SHA512 ab1f3330ddc4aa862bf95aa1840e2c402e228a206d7abdfbc6596009e8e20a65e17c34b1bb4b39fc1d1643d974cefc6b84826b5ff793e5d341ef7b6754badc82
SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXEX:GaoVmp+84YgcP/aK2vB+WiuWXK
TLSH
T1FA84381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4896	googleupdate32.exe
1316	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
240	1316	WerFault.exe	90
244	3872	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdate32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1316	eventviewer.exe
1316	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4896	3872	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	89
PID 3872 wrote to memory of 1316	3872	2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_84d9bcb82141303da585741aa8c27a8f_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
  "googleupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4896
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 1620
    3⤵
    - Program crash
    PID:240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 1476
  2⤵
  - Program crash
  PID:244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3872 -ip 3872
1⤵
PID:6140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1316 -ip 1316
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 196KB
SHA256 68e80bc5df63fa9ea4a178a223d0f9c13a1a9a84e66e959f477a2d6ba783acd9
MD5 c572b99ab086aa6167a4ed410a77c54d
SHA1 72f9e2ba4e0c0ae0b7095855c83e5612bb82c7ab
SHA512 201a457e9e139f252af195039e106bd5380c8e5f1891e8b7a00889d37c833f12797ef88bdc26986759f3c51f6fbafc51277c473f7178642e9ff1d0ad8d926b6f
SSDEEP 3072:hcxnwNwQ/lbQvPZc0KjVYQr/5xTBsvsCvvw11Ai6W:hkOIc0KVYy//+0CHUN
TLSH
T1B6141C286DBBB1619E4A8DE14CD6AE5643FD719F26023F0B4EF0AED01D436BB8E07440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 fa32a7d2563cd8d92aa0b2c13047df97d54dc52349355945cc735451eb00e5e9
MD5 f65f7ab05d0bb691145235f22ae8bba2
SHA1 78d4e05e1148514f4d93bf200ca7d7854892330e
SHA512 b68c568d9842dcb3d7802da628b14f6e52e9e9edfd049f6cdd8552411fefe8a64423c2860224511d91ff708b887d7544e849c1b4e93e96f44fd725a2a9d355ce
TLSH
T1C3C08C1C1BA20A06F2A8437C02C139139B208601F6428F051AF53A08C996B1A6938C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 c1b1027e4cf69011ce79e18b79c32f7b30b247c4fe837f92d94df525307f37a1
MD5 76c8ad8605a422661a28afcfd4b40c4a
SHA1 c72d1372b296faa7c999a5a621bb3d4ebbcc3e30
SHA512 424a6e172df7843b1e4e5b172d0a2bea288dc36d59a4262fcc06a9de080f0f0c6f9799f31492c00fd7b28c8f1dfc480d76e7c61e32760f980cca868e79d9b565
TLSH
T157D0232D27400532FC37233484560251FE406109F650D3090B33254DCC3DF014D51C1C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3ba32e4671152f6a3bf117126ec0d9f7dcfaed334af20cd8621f1fc2fb9c347a
MD5 4de9e6a8128b444c0ac8f0ae51426689
SHA1 f3ee5963013b8c964d0d1836c135d9e92b4ad33b
SHA512 8135e562f5ca838b64201e7a62aa51facaf94ea4addad82ef4440dda7abe308bcd39b925bb6a668043bc9f59520cba11c304503a135dabad196676111ecb84fa
TLSH
T18AC08C1C06610606F2A8A3BC02C279838B209510F381AF0126B92A08CD25F122834C39
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
Size 158KB
SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
MD5 5722709cb676e5b6f2473943f9e71632
SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
TLSH
T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 43513ec50691c10e7c20100ceb8f77e69deb63cb06e5535ee40c6a4a3920cddc
MD5 65b5c94458af8a942aff27f2cba53c77
SHA1 7d358a347aa5d3d3d346f1f9d425a068f40b6c21
SHA512 f6b3542a5f22b1c5481c926624dc06bdef9c47d212f47465aeb6a7e72c5c03d68363224eb3b9a38df54407e42076eba7044ee6320a087ee36da5189d65359b20
SSDEEP 768:HqQmVAz24xtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7Y:h24HyOTCasJY2aso
TLSH
T19DD21B7B8724087565E3034A6FBF7584B855A08BF502D4F4BAAF26052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 207KB
SHA256 df23b08fbdf3e2fd16ecc3060dc5251d8a0a918622087ab28a22146cbe771be4
MD5 a28864e09004c9812161c63c7ae29c44
SHA1 bc0381470a5b02a5f418dbcd7c24493b66518925
SHA512 e09ea23c3f0cca26551cab9e0b73ac014ca1299af17012d525e101ad4a1dce0ea41359d23f4fa7f01c2f5d45402db048267d7b3c3e970db3ed1c4f8592b7b7b0
SSDEEP 1536:h24HyOTCasJY2asmyvBRU8yhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:h1SOTy6pXpWCmAZBtRb1BAwMW
TLSH
T1E024287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download