d0e3af8ea1af11c0f54956470212601425b108b6096671a3d2333cd358488f5d

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261113-s69dcsds41
SHA256 d0e3af8ea1af11c0f54956470212601425b108b6096671a3d2333cd358488f5d
MD5 2410007863ae95437cda63f899184437
SHA1 87c546c8083abb3a47611c7968df4bd6f9182737
SHA512 cf86f14f183259493b2f1beec77c0cda0823f43ed2d41428188ad33b49ff97fc8ec5895ef0ce739b892dbb062a71fd4fad40147694895ed75d23dd4f992a2427
SSDEEP 6144:GjuDOhVL4RnCPXIYV540UVwleMITTmNv1ohWsqkiuW1FXE3:GaoV0q4Yb4lssmroCkiuWXK
TLSH
T112A45B1535E40AB2D16F80758AE04A66E237FC715F204FEB43906F597E32A905D2BF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1700	microsoftedgeupdatecomregistershell6432.exe
456	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2096	5084	WerFault.exe	83
4372	456	WerFault.exe	85

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	eventviewer.exe
456	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 1700	5084	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	84
PID 5084 wrote to memory of 456	5084	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 1328
    3⤵
    - Program crash
    PID:4372
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1860
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 456 -ip 456
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 836B
SHA256 10ce6a561968b29ac9d759ac8dbf69e4c2b2a775006fefbd7768f7515457a502
MD5 abba165d7e530bbd08c9428f8aec4273
SHA1 fd73fb2e8db7ca9a391b2925cef3399e75d43790
SHA512 60482859fe5a0fe5bd5a7046ecf59f9eb7273a75735b19b574f7ee7286a7ae4188135a88b98814428dff3beb00e8f149355035161f2a7918ae53dc7629c9868b
TLSH
T1C10186264D4B9D25E0E69CBC49A4CC1E0DF6B684D794F1594C4CA41C7008FCBDAAF0BB
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 242KB
SHA256 b50e879ee49ab9ad883b488a53dd0f5b014706df352e734f40a7720bfa3df763
MD5 c8826978d284ed108158038a0015b4c2
SHA1 42956dd9eecfb2e37071b55272fb819d33f774bc
SHA512 5b3c44ec5b02b57aeb43789dde5bc56ae291424bc81357dc0981253bc1e6cca1a5d4369e186617de9d0c016b9ce7734902bb11a26640e14464c9b6f86f1ab405
SSDEEP 3072:lsvAKblbXrmoT/0IARBmfUHqhEAsKTU+Km2brsoMizSzr2t0SZ:xY7T/0NBmfCkEAJDKm24oMYtx
TLSH
T1DA34DE589DF7F0565E8A9DE18C979E9647F8319B23427F1B4EA05FC01C17BBB8E62080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54
MD5 dfa839bff27e8a69f21a3d7850ba73ac
SHA1 699e5f1eafc4787d5ceac4070ff49d2a267a86a8
SHA512 60e5d5123effa49e64ed4fc2faf3be3937ad32f3e658354b57d16aa83ee09598911facbed9d8318d670c2cf52a61f716c257aa51114d69e9a23e3897544889c6
TLSH
T1660144B1BBBE6B347B829D4683F9EA021CE4B7B68C5061C9E445C85E4C1C3A2A24418D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 24a757a13ec405743d6e4f26d821ad4fe40e1db0cccd0fcc5c499d64a31d62c4
MD5 4104672fd69336db2942e56471e36971
SHA1 c294b900f4eeb3ef6024b325636e0ff2cff52a0f
SHA512 43257f31501bfe7b60ec32b5f1dff861fe77d3fa846fdaa48f826b9a4838c0bf3dc060dda32930dbfee49320bbac31324c72415a30630636f9f8fc6b5bea6031
TLSH
T13EC092045FA30366E155477E6A112B149AA0BA63E086CF4E06F60989E96AE222960D1A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 27137d6100c80f611b85d447a001b6b420fe51953797cd039069c0affd9e5f60
MD5 6b4c2c5274f4ca6a8bc1052478a82e25
SHA1 4711da075ec3e917317df679355ed2f9eef3539f
SHA512 c2a112341622904957efd427ccecc765a90f3033edc405cca72a090c7df6748d24defcdcd335192ae87da87d91edb89bd0faf2f9779e3d5ae6824567266743b8
TLSH
T1CDC08C908FA20213F01407BA66501A289BA07523E0428B0D0BB1044CD9A491115A0C06
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 de9d96e9635094eb35752a5ea82d16b3601240f5644f2f3b3f1c66cf9df3068c
MD5 d2d7bcd3ea292017d0109c9e0966aeee
SHA1 56658c1419cd7d2617a8866bb56197289428b650
SHA512 5e7369a3e1aae1fa8a1aa189fc800a50fcf1f3f1b841203eb3c41ea661a001bbb3a24aca7f04b91a98e0397b85ba963e7225800e7c53439262e618df433562dd
TLSH
T15BD022AB67100213F062CB76C0D136131EA03548B2818F040FB0231E583BE332C1281C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 dc8fcea57aa5361326e695c7d8b72c81830a2a2458e31c486a3abc9be2b11341
MD5 0c7377b64708199d6706a2e8e199f32c
SHA1 ed35116e4d72df68e436b2d8fcd7ad4aaae89e10
SHA512 69a1388c44f4bcd5ce2a1520cdbb3bea45dc301042c40f7991ceb0d2d4bf2be71c55bc62bb2d54443f3fe0258b2a0823a52aab308efc4e15963d7cf027baa64f
TLSH
T145C09B185B530315E15497BA9D51055445505916F0D57F1505F5054D5539F122460D52
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 4952d9092999e00d775b0be85b1263dab667bb10d76992301f93ace9cdb162fc
MD5 509904f5190fa4b931bb35a7ea2a5a6b
SHA1 0f5431e4435d83c29275d7ddcc00fb88aaacb0fe
SHA512 12b6dd6fa171ccaba3bb31674c540f667abbabbf5f18cc892910c88885c3756f71ff07f831ca8d5418c82dfdb3d1696237ebd9b4d81610fc87fcc3b18c982570
TLSH
T12BC08CA88B920213F01887FA9A9109A84AA06A27F1827B090AF1081C8938B0264B4C12
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 4283811be3074e66bcd8ff021a1e07bf82ab2db6f0fde0f656bb95ddd3847566
MD5 e7d5590ccd0ad9180f44c3a16b737d92
SHA1 29ae33a4f2198d5458b2a3d9aaf86d94e1004287
SHA512 87e638ee068758ba5a9f8667b577290f6d00ecf81063249149be3bf42cf746a978f0081989464bf52a1d60307611643ce5eb5169c59dbad84428d2ed2931a2c4
SSDEEP 192:g0QmVe+k2IUPnOlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36j:g0QmVez2PnxhbyO+OmtzIYu6MklE
TLSH
T17E42D67B5811842325F1515F7BBFB208E066F20B9541D8D1BE8C43052F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 d47ead96dbaad069155d85fbf3bda0904c3f40ed0ad104c3568f0778c8f88ca9
MD5 7f4e93f1dd27ecf97e9ff3db6d999859
SHA1 6d925da74282ccad3507ab9bd9f062598bd47af7
SHA512 1668aaa43f9ff0acd8261f269e204b40a989712975f6189fc3570c59a9c1774b31bd6ec796d9bab9ff324e986997357f7aa9da3c91ab5269d7e9363827df5040
SSDEEP 1536:q2PHyOTCasJY2as2tvaRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:q4SOT067XpWC6AZBtRbfBAwMW
TLSH
T1FB24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668827A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download