8207eaa2b4818a6821d565eca3a77adc63d3e1f3439f1b222cb337c624703597

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 438KB
Sample261107-t1985ses7n
SHA256 8207eaa2b4818a6821d565eca3a77adc63d3e1f3439f1b222cb337c624703597
MD5 1883f0c059b35cb23a5efc10357af188
SHA1 5ddd9008f3b5cd6c1d12e82c3802146e510b7575
SHA512 b23f888b541805ff7dffce64f63b4bb905d924ea27646714cebf25ff77003ec00a2878150248eb80277457eae99deaae0c11f6758c1601dd30b0dae5fd93bab2
SSDEEP 6144:GjuDOhVLS5nj+CPXIYKAel/DRfkTC3dM7B+mCiziuW1FXE7:GaoVmp+84YKAelbRfky6B+mCciuWX2
TLSH
T12594E31237F84A68F4BB5A305C759F399A3BBC309E30E7AE16502A5D3D31A419D21B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4172	microsoftedgeupdate32.exe
3932	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6004	5132	WerFault.exe	87
1864	3932	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdate32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	eventviewer.exe
3932	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 4172	5132	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89
PID 5132 wrote to memory of 3932	5132	2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_1883f0c059b35cb23a5efc10357af188_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
  "microsoftedgeupdate32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4172
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 1900
    3⤵
    - Program crash
    PID:1864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1476
  2⤵
  - Program crash
  PID:6004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5132 -ip 5132
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3932 -ip 3932
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 244KB
SHA256 48c5de718a6251160e10c50254fe45176db642edf3c4ad372d9c7a3ffccc812e
MD5 4e3e3c61fafbbca6354b9c79ea221e27
SHA1 fd37b7f865762958de0bfe988bfaf50d3d6b643c
SHA512 22bcbfb5468ef429d3a80b993518a1ea85dd769f8bb7ca29ebc567b6e49cc4845d899cf0db2f34a24660f618c52a4c2b7e43a805ad0acd477c9f0282b5c334fb
SSDEEP 3072:MxyPs+4Q8lbXrmvUC7hxCmITBQrAsK5XLpenbgsTXi8oQmEjD7:OPcUCnCmITqrAJppeblTXJH3
TLSH
T1C434DD589DB7F0565E8A9DE18CD79E9647FC31DB22427F1B4AA05FC00C17BBB8E66080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b2885dec99536c54c64f35ffa5ad224a92338e8cb2c01c7175e9288fa139c3d1
MD5 78d694f3b6891eda8ba86f90b27a803a
SHA1 bd53eff038516829c68da7409caf1f390d8267a0
SHA512 8901e69ff79ad9b27587e9fc93222fcd91d1d2535e066574409d9478d29fa5b52206958e554d72eb521396819956e66d2b52a1ec3bae6bfad05c4763ef5e8a49
TLSH
T1FAC08C1C1BA24A06F2AC837D42C13A439F208101F2498F052AF12A48D996B163938C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 691c510e5ee1a6dcfc6c005af2fd16c8953d0e83012d3a2ba1c4321a1da38e5f
MD5 397c3fbdddfd9b8d67a21d464556d405
SHA1 dce6ebee54174ce8844aafb4d6d01a281468c85f
SHA512 fdaf09df8ee1ae0d6032d783ac1b35ec0a8ae5365c1e389d157f3f403e0e25c3b2c4aded533e582cf79dc87c38cacf1d11a083a52ec7d450d9ca5ea404340dc6
TLSH
T1B9D0C76817D14176F1754B3A147405905E906527B2858E2E277611588439D411C1190D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 2ffad5fe47b90f1bfc3ecacfd9e0d6758f35f03dcd977a85dcb4fb5a2a169ffa
MD5 0c555d7c83fb741fa25991563f459416
SHA1 1259864e6bd2afbda8eb7d8b74cf043e37187607
SHA512 1e12afac6a0a1499dd83371008a73f0b9e766538e528617140c9a266df9ae6686e8133873864cde92fe2b37181c07622687bfbb47aed434da880c2dac24b4675
TLSH
T1DDC08C1C47610606F2AC83B802C229838A608210F3819F0526B12A4DCD24F122CB4C69
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdate32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdate32.exe
Size 201KB
SHA256 14ba66344ddd4816d823d5ecc97bf94da5d441299401e8955f44b1df7969be06
MD5 d182a0d12ca3a95fe1f2f5134861ae1b
SHA1 0c5f3e8a767a2b5ab7510d6139f47336e333e906
SHA512 ab33ae1e3684c40b1a1d801d8b0ad8e0d624c9b3db60945a0c30a3efa02a2d69d284620859421407c9891db0fab4c4c57ece10b22b7b801dcb34ccd6f4ea2f12
SSDEEP 3072:xHrfzYoc6X/YoW4l/DReos0gXf+EvC6C36eCWdMuoB+ISzBqUGxNtvKAbFP3cSEk:rAel/DRfkTC3dM7B+mCi5
TLSH
T112146E2237F85A28F8F36E305C349F2A993ABC359E34E76E1644219E1D35A419D31B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 4dedd6fbad054620567f77e09afd3a266df62c6bbec07d93bd8851b2c318daac
MD5 819c6606087916de41cbb760d09a7487
SHA1 420ab8f3e75f824301b49d39111ed68578227d88
SHA512 547498f915b3ea243348862bcb7bb53ca04a700b2b6280e8e074f9c8bbe07d115994592aa47a5296f9843a2e7333ab6e06e73c695dc1ae9c177576a714387025
SSDEEP 192:V6qQmVA+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:YqQmVAz2PnxhbyO+OmtzIYu6MklE
TLSH
T1B542E67B5812842226F1515F7BBFB208E066F20B9541DCD1BE8C43052F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 f9129ef250bc90976c09f86691d36a1ccfdc9d76a9f786917d70111b72a1c8bb
MD5 9af316004ce2d2f7224f2f1ebb5dcd11
SHA1 265dc8f874da4b1d762591d4c5cba80a70c724e4
SHA512 454cded09609a2266eb5a700f6f79c57d5869b6d6dccad95687c7b252de1123672b4f03325e090c4ab8dbcbe017fc15bff2ae4ccc79b78dad3b9832368cdc4af
SSDEEP 1536:S2PHyOTCasJY2as2tvLRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:S4SOT567XpWC6AZBtRbfBAwMW
TLSH
T12D24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download