1c51a2a6470014971ad1075e68e04774e85cf01d140e5631af2d5417ad9416a1

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample261104-xapfjacw2y
SHA256 1c51a2a6470014971ad1075e68e04774e85cf01d140e5631af2d5417ad9416a1
MD5 64aa0cd77ca721d09c400f93b9bc31f4
SHA1 2129ddf0993eba953eef70a98c7186c2fe87f618
SHA512 fed48e14f510adb5d3d243ed6a9664a3e239f37e96cc025b4bcae2cdce2aefd3cb12e0d42e0ba2d8a04a72841d30ef7b8d2dd39e552054fea085a765e27d05f1
SSDEEP 6144:GjuDOhVLOdnhRPXIYwni3ZkQrBAmWt9h8QlLISZWVhohQu7dhiuW1FXEJ:GaoVqR4YWi3drBRy9hdFIdhoyYTiuWXQ
TLSH
T1A3947C1672D14EF5E17F403088615A75E733BC200F219BEF4364AF69BE326909D2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5776	googleupdatecomregistershell6432.exe
3380	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4488	3380	WerFault.exe	90
2032	3564	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3380	eventviewer.exe
3380	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5776	3564	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89
PID 3564 wrote to memory of 3380	3564	2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_64aa0cd77ca721d09c400f93b9bc31f4_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:5776
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 1884
    3⤵
    - Program crash
    PID:4488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 1492
  2⤵
  - Program crash
  PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3380 -ip 3380
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3564 -ip 3564
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 242KB
SHA256 b9130386f8dd6e7ccf4e4a405c75fe29dd7797ceeca222cae3a98e7564941b29
MD5 51284625ea5b18ae5eed2fe8c416c3ea
SHA1 f83da442f8f4b500cb7e34603e610367c5d0edd3
SHA512 71f9ec1c80c47c30056dcdef070b3b846ae136197d683d98615ef52140c5b62fd3fee988c80b2d522b4d1cab1528df5aa8e6048d6ab3943b3f2d8a3a0c2ae885
SSDEEP 3072:QcxyYBwQJlbVrysU07pmiMyBQRJdKeqLlvHbgsrYi8UojFi4e:QDg3U0AiMyqRJUJlv7lrYJax
TLSH
T1F934DC589DB7F0965E4A9DE18CD79E9647FC319B22527F1B4AA05FC00C17BBB8E63080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6f92ae7ccf13b996d0fb20338002b15835af5d64e4e050fac98e3409e0dc36bd
MD5 18fde7a8590849a1a7fcc61840352d93
SHA1 8a88b47a2d712d09cd2578b221cc3a98320cb585
SHA512 9ab7d26edcbb958f37312d033af4bb33b856f33e0794608c43e6e3876919ade3f9654db665aee600360b370da42197324b9d70ddb8265ece2e67fb6f1a1cc956
TLSH
T12EC022082B820200F28A033C228032028F808200EAA08F0A0AFA0A08C22BA083A20C2A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9fd8fd4ada145913d93803b727458613c05d901e436d23df4c980b6b4418b21f
MD5 3c1c934968acd2b724b4cb3929bad270
SHA1 f629394a54579864fba757df0c9fc9fd68632ece
SHA512 29692779479a9ca20d4a8d978fd29590df198a33df49e1c8581b4d8c51623c594eff627eceb35f468af85bac085673cc2b9d092c097cfbe8343bdfa5ed53d6ae
TLSH
T1F3C08C2C1AA20A06F2A9437C12C139039F208101E7418F051AF57A08C99AB162D38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 fa147b4663388d3dc607aa12b0fa72b64a94189d61e8fa83c43a115ade2bdf7a
MD5 2567a942f9474b429ad31284aeb8709f
SHA1 8eea9d4d3d8d8ebdb2cc7c2ab82ad3b4e5e336ea
SHA512 6a42c6629d0ba08c9633c1c8fd93c8a8f06b32829f37f8e12545f8d0328d4fba1917cf30673bca900585c49abe15ba3f4c5a9d55ca84fe1928672c52aecdcc6e
TLSH
T1A9D08C2C1BE00226F25E8BB684350680CE907151EA858B4D11BA284E8C2FF022C62C0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2428941a05110f684e9a397fe2155a7df6e8d083d40311afedf99156d49baaad
MD5 e4ca2a9ca3e5ea5d405ba71337c8f655
SHA1 d0ff1fc8df9cdf39c22e5ea76bbdec6126c90cd8
SHA512 482f37763559dcefd07d6aa7c386ebe2be786771c761bf533971809f0f9f6cc6350255f459769906d6edd499a8a0e63c10019996346cfc6412f9b041d81e576c
TLSH
T165C08C1C06610A0AF2A883B802D239839A208110F3819F0127B13A08CD28F122C38CA9
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 ff18cd0dbb9d301814752cb2cfffa0c29dbb6dae480caada5e05c04ba93042fe
MD5 51e26c9f89f40f7ea923b0a8a341535e
SHA1 e0eb7d322add2cb3fc7f3ef6b934be69f1246bc8
SHA512 710ef2eb5b8a10c26793426fc7e923ce82070a3fd9eaab0dbfb3c670fe71fe5523f9d20f147bf849cd254d9eaec65f85b7099e02f306266498c95e7c0c1498be
SSDEEP 192:yZQmVf+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:yZQmVfz2PnxhbyO+OmtzIYu6MklE
TLSH
T1B942C67B5811842226F1519F7BBFB208E066F2079581DCD1FE8C43051F927ABE572E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 1df93a3d51dda4f43002586751f24c63cc525836774b0b0e3ffd5b952e991a7e
MD5 5db259fb705df1d1625276c92f247227
SHA1 d7d7f69d496f66d02bf4f5f7d81b24f70db37c68
SHA512 5ea0fbabf30e1d2fe10cdcbcf850fc1e3d009dc02bb76034f0a074f0ca1fc2e6d276c3d4d0bf719d398444b3315cbdc272919ffa8c9c647fbee5216f69e757a9
SSDEEP 1536:q2PHyOTCasJY2as2tvHRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:q4SOTV67XpWC6AZBtRbfBAwMW
TLSH
T16024287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download