be118a462f13695bedb27fa342207c7e69a9a9f781a1ac9df7635fb3035d6541

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Size 335KB
Sample261110-hbf38ade29
SHA256 be118a462f13695bedb27fa342207c7e69a9a9f781a1ac9df7635fb3035d6541
MD5 8c923787716532e88fd03f416399dd1f
SHA1 d1c6c85265626541b9fff8a2b834c84ff5e69281
SHA512 7edc3c4749e4fb87e7282d9a7f4bd5510644484664995e1f18e8af864a63c7d23a96d8e1ec5fdd1ef361e53d5c8d3aef2b52d71c179d3a3ffb1ca0f9d3776823
SSDEEP 6144:GjuDOhVLS5nj+CnXIYLIkifYUGrTB+AleaiuW1FXEH:GaoVmp+04YLIkOkTB+weaiuWXe
TLSH
T117749E1336D084B6E1A4043148B5AF749A7AFC701B219B9B73947B6E2E31BC0D93776B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1580	microsoftedgeupdatebroker32.exe
4188	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4360	5960	WerFault.exe	87
4920	4188	WerFault.exe	89

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4188	eventviewer.exe
4188	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 1580	5960	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	88
PID 5960 wrote to memory of 4188	5960	2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_8c923787716532e88fd03f416399dd1f_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
  "microsoftedgeupdatebroker32.exe "
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4188 -s 1588
    3⤵
    - Program crash
    PID:4920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 1476
  2⤵
  - Program crash
  PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4188 -ip 4188
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5960 -ip 5960
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 240KB
SHA256 174cb1ecde2803fa5d8cabcac9997dad4999451cc6dba8d3f6064d39a10b54d9
MD5 588da0e225fdb62d98eb4fe198004843
SHA1 51bbc2995fc7732ede97fcd9b11d948f7a8d0141
SHA512 2399205154cf4ac4a98d81d2bedc665e8153862b0f71d5c22439b18e6048be1ccaa38d72a86e6319ba52c6389ba0f980daba5b657ccd5327ed47115e52dc7247
SSDEEP 3072:3Ps3iI8lbXrmoNMCUhBCm+UHBFBAsK7XL4e5bHsoXioBJmflDJ:fH7NMCACm+C/BAJv4edMoXj6t
TLSH
T15734DF589DB7F0565E8A9DE18CD79E9647F8319B23427F1B4EA05FC01C17BBB8E62080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 79c4a518188ac168fe5ffabc8c791c5972bd81067e20f63de47de47758b97a5d
MD5 2283c2fc3c1342e9938f2346d8263d32
SHA1 88434249fafc2d8e696610c68ec6a085adeb40a0
SHA512 01320163f105256a135ef5fb79c6a7cf81bb978617a1f40210ffb01821e68f5cc9f11c84f2abc7cb8cf7fb11a8b35d5ee6f9468e84baadbfbd9490226c286c74
TLSH
T1F4C08C1C2EA64A0AF6E8837C42D239139B208902E6418F051AF56A08C996F163878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 575d94645983633e3afccc09289ef027aa48700d14b23ce6d55795b24145a761
MD5 f49012ebe70b2cd7f698d94b63c1dc63
SHA1 05b93bcdfa650b3be0fc3a909b9a7fceb131a4bf
SHA512 8b980e2192d0f30519951c47defb22f9ab100cd32b0993663c0ed659ec90d4fd7fc53cc8294b4588ad647903a287ccad011de10f354828406982f91c65ea3835
TLSH
T1A0D022086BA18232F08083B6C4F20692AFA07526F181A30D8FA1D60C5C2FB131813C2C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b2094ed5c46054cd9c3a1cd96f3bad374f16a76ccd967804418bc02a3e6a547f
MD5 b63d4f12cb3059c5bf085cd7570f4b1b
SHA1 360a65e21645be3f053855fbabf036ff1be0ea2a
SHA512 62593882942c4dc45e6225ec0a2c33f886f3940e8c4207ebfe3fd3f18094ba4f9320b63cfb6d614ed68b3402e1853321d107e9f541a38381badcc37fd7babff0
TLSH
T1E7C08C1C17610606F2A883B812C279838A208510F3819F022AB1AA0CCE68F122874CA9
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatebroker32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatebroker32.exe
Size 98KB
SHA256 fceaa64f61dbf520dd41711bb6fac16607e52f59731a5063590c1b4c5584587c
MD5 b8d21dd3cd6c49ab0d7e378d74c54ab1
SHA1 ed6642a2c2928c94605e0fa1d25721e20ec80aec
SHA512 4d49dd5c4687083cf6286607ca4746d4063b37743d93c14e43618d7d3d34349769c7746bd0e44cae69bae57ebb1f4838096f43deaae44c55f91dc9e9b4262f36
SSDEEP 3072:BxUff8aohGme+YDfYz8FrRs684ePKoTB+IvoAewV:vIkifYUGrTB+AleE
TLSH
T149A36B1375D088A1E5B21C3049A0ED719E7FFD620B509EA7338466BE0F317D1DE36A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 5f0391163564344a3dd45df9cd92e3a8f73ee163b0aea3ce4930c44904a5ce1e
MD5 c4150b763490d7499fdce808a2dce53b
SHA1 a7142bf4bbdc0ff290ca2b9fa6d27868ad00409e
SHA512 7e8b4f3326b74df7dec302278c80565d15e70aa9741bc04dfa1ea80b10f4354fcb0d0424bd9719a2e791e7065691061a19d7a27ea766325a1d376892f5c95208
SSDEEP 192:OfQmV5+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:OfQmV5z2PnxhbyO+OmtzIYu6MklE
TLSH
T16B42C67B5811842226F1915F7BBFB208E066F2079541DCD1BE8C43052F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 c46cea8e9356029f2b13eb8943ab7529ad051006560f32e106893fd0aaf78182
MD5 c3684ed88b06bbee216a58bdef02417d
SHA1 f0513a251e9c3112eee70cd39681a15ff75077c5
SHA512 776cfa73d0c22554787cd39bb93f4fa36dd6b6c2c2f8b70e5e3737cb991accc513177d421b7a85ab6485ee52915f8e6f1d9b7abd1253d5c7af3cfa7d1eba8be0
SSDEEP 1536:a2PHyOTCasJY2as2tvERUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:a4SOTi67XpWC6AZBtRbfBAwMW
TLSH
T1A124287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download