Overview

overview

7

Static

static

3

2026-04-16...uc.exe

windows10-2004-x64

7

2026-04-16...uc.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_5f77abb3dbfa4afc30ed3f99eebe2742_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 454KB
  • Sample260416-cfc98sd13p
  • SHA256 afb8222d412876a4c592708da9165fdc1f470fa2ac5082e7cc2310d7e736bf75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 10 IoCs
  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_5f77abb3dbfa4afc30ed3f99eebe2742_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_5f77abb3dbfa4afc30ed3f99eebe2742_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
      "googleupdatecore32.exe "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4348
    • C:\Windows\SysWOW64\eventviewer.exe
      "C:\Windows\system32\eventviewer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1556

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
        • Size 734B
        • SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 4KB
        • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        8B3C0310C2EA810C48E449EA75059E8A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
        • Size 493B
        • SHA256 68b50ab5a0b4898d98d133070dfbaeb3402547d8294fb1a6770868cd75e12f30
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        103621DE9CD5414CC2538780B4B75751
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
        • Size 192B
        • SHA256 f4dfa5b3d73fced354fe45f7528df9dfa4a9f32691dd595ab33a6b20cbc80939
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 342B
        • SHA256 bf7d9b33b0d4f781cb7c1ec31eaf4f3685914efc07354413315e9fb04b2f82c0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B3C0310C2EA810C48E449EA75059E8A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
        • Size 248B
        • SHA256 d1ea2d0bee3660decb82fabca33040fb6f4ab47c7ab8c64ac54957ab635def9a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-04-16_5f77abb3dbfa4afc30ed3f99eebe2742_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_5f77abb3dbfa4afc30ed3f99eebe2742_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
        • Size 454KB
        • SHA256 afb8222d412876a4c592708da9165fdc1f470fa2ac5082e7cc2310d7e736bf75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        googleupdatecore32.exe
        • Path C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
        • Size 236KB
        • SHA256 d4cc69eb33ecc1caeb3e09e7f68c16ce66beebc9398fb201b128ae62e2bb0d41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        googleupdatecore32.exe
        • Path C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
        • Size 217KB
        • SHA256 25ba4af76f5bfdedbc61cc97dcac8bb6b4ba5e53b50a7566be429cdec61943e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tmp1D62.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp1D62.tmp
        • Size 152KB
        • SHA256 c8b8db63ea0d66c3212318e02ed65315212a565821b41e648b62125ce491a54b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        eventviewer.exe
        • Path C:\Windows\SysWOW64\eventviewer.exe
        • Size 88KB
        • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        syslog.exe
        • Path C:\Windows\SysWOW64\syslog.exe
        • Size 148KB
        • SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/436-30-0x0000000000B10000-0x0000000000B8B000-memory.dmp
        Download

        memory/436-56-0x0000000000B10000-0x0000000000B8B000-memory.dmp
        Download

        memory/1556-31-0x0000000000670000-0x00000000006EB000-memory.dmp
        Download