b9ae9d7903eae70ab7963afc8ad1a8936b20d94c461eb9c77bcfc84ba999ee85

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Size 418KB
Sample261107-mwwrmaxxev
SHA256 b9ae9d7903eae70ab7963afc8ad1a8936b20d94c461eb9c77bcfc84ba999ee85
MD5 b60fca5d9d54d2d51781d31a6aa3dd68
SHA1 6637d367e8fbdd9ae4fb153e689cf4ce3c77eb3a
SHA512 5714069b2f45dcd2583fa7d6f884369f60b0de2799c6a5c43d8aa9680ea624b5030f3329a5c11367d9e510c039f6f4742cc0e5a1f4a6d4d4dcb876e5cc290321
SSDEEP 6144:GjuDOhVLOdnhRPXIYwni3ZkQrBAmWt9h8QlLISZWVhohQu7dhiuW1FXET:GaoVqR4YWi3drBRy9hdFIdhoyYTiuWXO
TLSH
T135947C1672D14EF5E17F403088615A75E733BC200F219BEF4364AF69BE326909D2AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3228	googleupdatecomregistershell6432.exe
3860	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4912	2488	WerFault.exe	86
1076	3860	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	eventviewer.exe
3860	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 3228	2488	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	88
PID 2488 wrote to memory of 3860	2488	2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_b60fca5d9d54d2d51781d31a6aa3dd68_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
  "googleupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1884
    3⤵
    - Program crash
    PID:1076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 1484
  2⤵
  - Program crash
  PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2488 -ip 2488
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3860 -ip 3860
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 243KB
SHA256 22651a6d85d13c2d5e8f660dbe528402d1b88dcf72a5dea14ace484576994342
MD5 728da0e69d40c1396ae91b8c441bebd0
SHA1 adbdee4b9a37071768ebedf48432e4f69701ef39
SHA512 8df1e14a30a35f362f375e6c7221ce64be2b620b7e5040392bc099a6e34a38a99fc5c7f763b66abe3f7eaed130d4beace77c6ec55c72caa7010d19570a9709ef
SSDEEP 3072:HxyPn4Q8lbXrmNUC7hxCmYTBQrUsK5XLpenbgsT2i86QmEj4m:RPUUCnCmYTqrUJppeblT2JVp
TLSH
T15734DD589DB7F0565E8A9DE18CD79E9647FC319B22427F1B4AA05FC00C17BFB8E66080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ff23ccdb161391b8067482981e350f42b0bbb7475a54bb9ecdeb928d45f6f77b
MD5 ab6c7f2c399aa66b5fa0b12cf7f44421
SHA1 f866ddbe44286e003f57ee45c38eee3196d1c2cd
SHA512 0af6a1ddbdf4cace3432927040bba941c229aa85ba43423a88eb51aabd3234522e01d67e40963fc30f8bdd5d798b65b7a41ca1431083317db0b661a2d56b45ad
TLSH
T154C02B0C1B420600F18C433D118171418B404600D0408F0509F1070881179047420C2A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 17306b21f8515c90e110234523dfe317a1a3058331ac1a5706bd4852d768dc20
MD5 3f774d1a2dfb638eaa1ba05de7e67f8f
SHA1 38c696daa4df2e868f48a86bbe5bb979a6b5d60f
SHA512 1e3d992676c3f6c9da345a4d00168828bea52b67c63528d5c677e30730a8f2a46fedb83f0c7faa3af81fb43c4466bce2c6c712ae9e095a02bccadf9aa11aee3c
TLSH
T1CBC08C1C1BA20A06F2A8837D12C27D539B208601E2418F052AF16A08C996B167838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 22cb050d713ba608e2a999fcab7fb1988ef9fc600271f46b225eead001223317
MD5 7bd3f46f57a85d28d9d7805d673e4bdc
SHA1 13f1d35e5e8fe53a0e8d8c99eb164afa257d6e74
SHA512 db26b0bf8e934a567485757a64e966b8da2d225550923e27cef39ada14b26a6c78a34da107d6abbb303877e3b171d44396dfa9dba3d5e6701c462cbc8ef3f651
TLSH
T199D022281FA50273F014833E88B007C21BD061AEF583CBCE7B24162D881DF210853D0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 e34778fe778cd31c6e8d7c1677aebe0b98dcd84d2a8f8ec72b73d376b6f3111b
MD5 016f1027292214989687d07a956a0b58
SHA1 aa90f083b416ef4865ad17e9bf3be3454b6e4f4a
SHA512 985605585dcb64d001e709fd60ad5f5df1ef6db3c36a44d1893ffc56a8fbec84e5f0eb227e31ca4e11b8fb9b77eef696682dfa884402170f443ab030886105b1
TLSH
T147C0920C9B664215F28897B9529262828A909610F591AB1626B60A0C9A3AF062870D6A
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecomregistershell6432.exe
Size 181KB
SHA256 f9a6647b72d9a8f98f776a2ee202f90231b2b3b5e7fdc91b60f42d6aa77f151b
MD5 c2c0992a4565b32faf92cb0b21765ca8
SHA1 8ba3d1e28dfc8e30bb8c260498828fa5ec424077
SHA512 ed86f654fea772721123f491c7d61e40b4253d6126ff903c832723240d0bbe9259b1ee2f1a19768bc41f42d545249537b5f99df6492887496925488f62e29a45
SSDEEP 3072:Dni3ZkI1rXRAmWt9h8QlLISqG+T1DpN9qEKLmoY46WK5CB+O3dnDdEx4:Dni3ZkQrBAmWt9h8QlLISZWVhohQu7dP
TLSH
T14D047C1A73A924F9F1734038C8515906FB3374650B70DABF03A4837ADF77294AE2AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 4ac8630a148e1287341370e37d04b5d287e6d9bc87e8df5fadbf777b64cee6d0
MD5 4b4f46ea03e06a58b93546ed25c20298
SHA1 316fbd0664a42954c09099bded73d154c3c7825c
SHA512 cb76b9a65fa81cbce029c368ad2df5398dea3fa5edf9c5ac734a7ddad0b05cebc51269c0cb818089403af18d58b2ae378ae188d8530ae28c3bcbb9ed18dc80b7
SSDEEP 192:eqQmVA+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:eqQmVAz2PnxhbyO+OmtzIYu6MklE
TLSH
T1AD42E77B5811842226F1519F7BBF7208E066F20B9541CCD1FE8D43052F927ABE572E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 5daeae304eb42759ae735aba91886047490ce8161070fc6651859015fb567678
MD5 5e55ed2df0f055f2a800819ea737a835
SHA1 84e9d9f4063423b8fd9b29446d26677c7f669e11
SHA512 b1bad94c472512bc10f3c51aabf20eb130a17ac6eba219d7fb6007f306a645d5457118debe97a5140340b603109a571a909e3c2aeb7092f6fb089cf1b5e25844
SSDEEP 1536:E2PHyOTCasJY2as2tvGRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:E4SOT867XpWC6AZBtRbfBAwMW
TLSH
T16A24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download