Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 01:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
- Size 405KB
- Sample260417-b7rfhadv9p
- SHA256 db9feb1875716afaddbc034729342caf8cd03d00b638031abefef51665e21d74
- MD5 8e9a5491c0ca699c490b8048310f5225
- SHA1 6a7934a4ea3ba7af4fdfcb62c1bffa5d9f02d578
- SHA512 2a1f8f46adc00e32d39cae64d80c73c6f477882e6d6b4d6a985f5bb8ed659e72dc13fe721b62962ffabeaadabb0410a31bccafaf04abdfbf5a88effc8189db62
- SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXC:GDVqlzYxGBcslpiuWXC
- TLSH T1C3947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1524 armsvc32.exe 5036 eventviewer.exe - Loads dropped DLL 14 IoCs
pid Process 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\eventviewer.exe 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe File created C:\Windows\SysWOW64\syslog.exe 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\java\jre-1.8\bin\policytool.exe eventviewer.exe File created C:\program files\microsoft office\root\client\appvdllsurrogate32.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jarsigner.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msotd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\idlj.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javacpl.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msouc.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\pdfreflow.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jconsole.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msoadfsb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\namecontrolserver.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\onenote.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\pdfreflow.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\shapecollector.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\idlj.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\javaw.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\extcheck.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jar.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\integration\addons\onedrivesetup.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excel.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\ink\inputpersonalization.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javac.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jps.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\keytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\policytool.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\integrator.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\keytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\tnameserv.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msosrec.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe eventviewer.exe File opened for modification C:\program files\internet explorer\iediagcmd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jinfo.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\onenotem.exe eventviewer.exe File created C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\klist.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language armsvc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe 5036 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 544 wrote to memory of 1524 544 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe 84 PID 544 wrote to memory of 5036 544 2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\armsvc32.exe"armsvc32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1524
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5036
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
- Size 168KB
- SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
- MD5 0b6178b0febd39f9abf211b13dcba2d4
- SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
- SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
- SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
- TLSH T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 78b24eecad5149f76fa62fa97cd271eb5bc40fd96d733f9c7f66ce260600b2c2
- MD5 8456b26d08f4affd22db1e379de58be1
- SHA1 8f6e6e89bc53a86f07542c4c2ccfff39fdfff803
- SHA512 a6e1a46d7fd604ecc0512e689e6ec86d42f9d62695a9d193f77a23e1f5b90fa79ddd114231de3ef06ff5caa0b383e0c30b30ecd48b1fadd14815350081d049bb
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6Pdnj+CB5XIYnQB:GjuDOhVLOdnj+CPXIYy
- TLSH T1CCE3491232D1CFB9E1AF45318DA29AB546B7FC319D3297CB13907E4D3E359418A2A363
- MD5 SHA1 SHA512 SSDEEP TLSH