d0e3af8ea1af11c0f54956470212601425b108b6096671a3d2333cd358488f5d

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 15:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Size 449KB
Sample261113-s69dcsds41
SHA256 d0e3af8ea1af11c0f54956470212601425b108b6096671a3d2333cd358488f5d
MD5 2410007863ae95437cda63f899184437
SHA1 87c546c8083abb3a47611c7968df4bd6f9182737
SHA512 cf86f14f183259493b2f1beec77c0cda0823f43ed2d41428188ad33b49ff97fc8ec5895ef0ce739b892dbb062a71fd4fad40147694895ed75d23dd4f992a2427
SSDEEP 6144:GjuDOhVL4RnCPXIYV540UVwleMITTmNv1ohWsqkiuW1FXE3:GaoV0q4Yb4lssmroCkiuWXK
TLSH
T112A45B1535E40AB2D16F80758AE04A66E237FC715F204FEB43906F597E32A905D2BF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4596	microsoftedgeupdatecomregistershell6432.exe
4352	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5284	4440	WerFault.exe	88
4492	4352	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	eventviewer.exe
4352	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4596	4440	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	89
PID 4440 wrote to memory of 4352	4440	2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_2410007863ae95437cda63f899184437_cobalt-strike_elex_emotet_icedid_nymaim_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
  "microsoftedgeupdatecomregistershell6432.exe "
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 1512
    3⤵
    - Program crash
    PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2008
  2⤵
  - Program crash
  PID:5284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4352 -ip 4352
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4440 -ip 4440
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 836B
SHA256 10ce6a561968b29ac9d759ac8dbf69e4c2b2a775006fefbd7768f7515457a502
MD5 abba165d7e530bbd08c9428f8aec4273
SHA1 fd73fb2e8db7ca9a391b2925cef3399e75d43790
SHA512 60482859fe5a0fe5bd5a7046ecf59f9eb7273a75735b19b574f7ee7286a7ae4188135a88b98814428dff3beb00e8f149355035161f2a7918ae53dc7629c9868b
TLSH
T1C10186264D4B9D25E0E69CBC49A4CC1E0DF6B684D794F1594C4CA41C7008FCBDAAF0BB
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 242KB
SHA256 b50e879ee49ab9ad883b488a53dd0f5b014706df352e734f40a7720bfa3df763
MD5 c8826978d284ed108158038a0015b4c2
SHA1 42956dd9eecfb2e37071b55272fb819d33f774bc
SHA512 5b3c44ec5b02b57aeb43789dde5bc56ae291424bc81357dc0981253bc1e6cca1a5d4369e186617de9d0c016b9ce7734902bb11a26640e14464c9b6f86f1ab405
SSDEEP 3072:lsvAKblbXrmoT/0IARBmfUHqhEAsKTU+Km2brsoMizSzr2t0SZ:xY7T/0NBmfCkEAJDKm24oMYtx
TLSH
T1DA34DE589DF7F0565E8A9DE18C979E9647F8319B23427F1B4EA05FC01C17BBB8E62080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54
MD5 dfa839bff27e8a69f21a3d7850ba73ac
SHA1 699e5f1eafc4787d5ceac4070ff49d2a267a86a8
SHA512 60e5d5123effa49e64ed4fc2faf3be3937ad32f3e658354b57d16aa83ee09598911facbed9d8318d670c2cf52a61f716c257aa51114d69e9a23e3897544889c6
TLSH
T1660144B1BBBE6B347B829D4683F9EA021CE4B7B68C5061C9E445C85E4C1C3A2A24418D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ea756bdaca07af819d0f3e8c424624442170574fc0b4043db29e35fe4519ee36
MD5 9abbec10ce0d87daf382a32bc0c1eca4
SHA1 1ee888c64981f4998a026e12f8880c7d2968d23a
SHA512 e97b40ea93c21737dcc6cd62e918b21bf458f3b1a5a7c805cd873276cf0714cc853c9909f818c3307903af37114777c2940156bed854caaba8dde5120a85805b
TLSH
T1D2C092445EA30366E554477EA911A714AB90BA27E086CF4E06F6098AA52AE222960D1A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 016276a4d29bae7a45e662e808f5cfb1a22031f230c516643d8db840dca40fd9
MD5 9fafe9d4fd396b3dab835b6eaba22ed4
SHA1 fbeb9b6a159d7874c9edaeb0057fc97247290504
SHA512 a46f049500e84035693b767b5b942c34eaadd206272e7d6ad825dc17c4e90d2bedd912453f8a1b048e364569878f0a1b0ca3debd9d642129bb4884b4bd9f3628
TLSH
T169C08C908EA21213F01407BEA9505A28ABA07523E042CB0E0AB1044D996492215A0C05
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 292e254074eada8543593526be0319405c14aff308dc82b9619b3c75c88c8827
MD5 74212a69229e0f3323ef12d729b4030e
SHA1 f15163197e5a867a863a73d907ca1f793e861f9b
SHA512 a32ecf1c95d4102077ece35ba9a95e7a4ebbdce46f5a24a2586c6a8e6735f9e67fe906989a184d3eb9869651fe799cd0dea74a48b70a8bb25a125c14f07098e9
TLSH
T106D022AA27010212F052C736C0D13A131EA03208F2818F050BB1231E983BE333C1281C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 fb390615a6cd7633898e54589076998d5675927047de96dcbb40f036ceaf4e97
MD5 6693096c78b9ef133594a0115e56a414
SHA1 1f40f4e57cc13b32fbf74dbb088aefc548b57a67
SHA512 05c17dd3882748cfa7234653dde663b36b23e4ac0f90daf9136ec121a33d331e7dd6a09165fcfc69a8c6071fe5b3b4be6eb1d604ef6062dd5399bb5c9f3773a6
TLSH
T1A6C08CA88B421213F01883FAA99109A95AA0AA27F1827B090EF2081C8A38B0264B4C12
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecomregistershell6432.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecomregistershell6432.exe
Size 212KB
SHA256 2570f92864ae626cac90f2192c1a5143cdec5fdf65c9638f4bce842b9fb3ea34
MD5 aa40483e78012d125b1b9d2fc64ee27c
SHA1 0a00181082545626eb5644cac1cdb78904e476b0
SHA512 462545b3a69b14464234db3765ecfa4aea5581cf4b4e501bb2fb26e9bea047fe0b40bf2951df16c50b4f7443409af94a247a2013e1855b04fe801ff7a55864b4
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YV:C540UVwleMITTmNv1ohWsqu
TLSH
T13F24086925F810F6D1B6D1B48BD08A43F231F87667208EFF4391435A4E23A916D6BF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 209KB
SHA256 d47ead96dbaad069155d85fbf3bda0904c3f40ed0ad104c3568f0778c8f88ca9
MD5 7f4e93f1dd27ecf97e9ff3db6d999859
SHA1 6d925da74282ccad3507ab9bd9f062598bd47af7
SHA512 1668aaa43f9ff0acd8261f269e204b40a989712975f6189fc3570c59a9c1774b31bd6ec796d9bab9ff324e986997357f7aa9da3c91ab5269d7e9363827df5040
SSDEEP 1536:q2PHyOTCasJY2as2tvaRUGWhFOQpbHtp+wcQkM4cWSprWPnOEDkLZBtMascbfXNv:q4SOT067XpWC6AZBtRbfBAwMW
TLSH
T1FB24287153F009BA60C343A8BBA576697D66D14BF553D0ECF3AE42102F83D668827A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download