Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/11/2026, 00:23
Behavioral task
behavioral1
Sample
2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe
- Size 8.0MB
- Sample261111-apwrtsd14t
- SHA256 3c9fa01357489cd246b8fd237f10426ee413b6c990d22ca1334f1df1ea449306
- MD5 28a2cf398f578d479eeb2a6646d34f20
- SHA1 c331e4e3881b93a50d978d10dc0c25469770e549
- SHA512 4501860218635deb6d306a972316fa9dff5e601a5145461a2cd6704bd36d7894e232268c3fae776eb18f5cc435b4b03952e9527eaf57a8e76ced9376dc4d1942
- SSDEEP 98304:vSEMSE8SE8SEFSEFSErSEFSEFSEFSEFSEFSEFSEFSEFSEFSELpi3:p
- TLSH T13D868E11BDC18033C2B338704679D5B26EBEA9321D31628F93991F755F705C1AA2A7AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c55c-8.dat family_shodi - Executes dropped EXE 1 IoCs
pid Process 2280 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\CLVIEW.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTEM.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\updater.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\ssvagent.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaws.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\javaw.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.usa 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2280 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa 2280 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa 2280 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5224 wrote to memory of 2280 5224 2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Users\Admin\AppData\Local\Temp\2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usaC:\Users\Admin\AppData\Local\Temp\2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2280
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\2026-11-09_28a2cf398f578d479eeb2a6646d34f20_elex_hawkeye_icedid_nymaim_remcos_rhadamanthys.usa
- Size 453KB
- SHA256 d2893c55259772b554cb887d3e2e1f9c67f5cd5abac2ab9f4720dec507cdd290
- MD5 96f7cb9f7481a279bd4bc0681a3b993e
- SHA1 deaedb5becc6c0bd263d7cf81e0909b912a1afd4
- SHA512 694d2da36df04db25cc5972f7cc180b77e1cb0c3b5be8b69fe7e2d4e59555efb8aa7e50b1475ad5196ca638dabde2c796ae6faeb4a31f38166838cd1cc028149
- SSDEEP 6144:s78n5Qw0tneDA/sqhleIc0HftDrkYY1hj63hgDonsogCh6NEpAFM:G85bM3npxYfj63hgD1ZiL
- TLSH T156A4190277E99135F6F31B31AEB592615A7ABC729D35D20F23C41A0D0DB0A90EA75B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 8.0MB
- SHA256 cde62cb373492a119fdd6d0e3d0555df50048e958d05ceca1b7fbab2399c6997
- MD5 43315cd6386b0b4384eabc658fe880a5
- SHA1 06e8383d38ff7a448c510237958d0fe99637e808
- SHA512 22176e18c6fd0d863e792a49c918ef5cc5a322c941a4fd6a86bc63fa8abf83e5f3ef75224667566e9ab839cc2a2bd83e88eb8b70c2b9c19aeabb9c385075edd7
- SSDEEP 98304:2SEMSE8SE8SEFSEFSErSEFSEFSEFSEFSEFSEFSEFSEFSEFSELpi3:s
- TLSH T199868E11BDC18033C2B338704679D5B26EBEA9321D31628F93991F755F705C1AA2A7AF
- MD5 SHA1 SHA512 SSDEEP TLSH