db9feb1875716afaddbc034729342caf8cd03d00b638031abefef51665e21d74

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample260417-b7rfhadv9p
SHA256 db9feb1875716afaddbc034729342caf8cd03d00b638031abefef51665e21d74
MD5 8e9a5491c0ca699c490b8048310f5225
SHA1 6a7934a4ea3ba7af4fdfcb62c1bffa5d9f02d578
SHA512 2a1f8f46adc00e32d39cae64d80c73c6f477882e6d6b4d6a985f5bb8ed659e72dc13fe721b62962ffabeaadabb0410a31bccafaf04abdfbf5a88effc8189db62
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXC:GDVqlzYxGBcslpiuWXC
TLSH
T1C3947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4712	armsvc32.exe
5140	eventviewer.exe

Loads dropped DLL 14 IoCs

pid	Process
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe
5140	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4712	4676	2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	79
PID 4676 wrote to memory of 5140	4676	2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B3C0310C2EA810C48E449EA75059E8A
Size 493B
SHA256 41bf1a0ac518d6992a61adb4a88dba4f69af360dcd3f252ed10ba92d214be2b5
MD5 d1c2ba3858158bf130071448aff874c3
SHA1 60231ea1987748872884fa4beaaf3966fa3987a3
SHA512 774027d45f6c0e7ba1aad00103a6fde4208943c390d95dedade2c1e65dacf36760a905432e0d5f1446f294dd7cee4dada549c86d410c95f60d297255e77b4633
TLSH
T1BBF0C961A79C390327F03D1663C2D41FDD70528005807E4C22E0419468457F0A980ACB
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 8f9f1e8533901ba79c70ad18d08ef9d6c04a429ba735e6122a7b550be60cbdd9
MD5 c266cf655e50c5af5e9d4838c441d56f
SHA1 2f5ecf002322f2e8a4656ee4ed8f86586fd8f42b
SHA512 391896aa8bb5921cd33be9e4bdc93c588d81fd66c1e844cab69b4d46d3426e8bd156fc170fdc9564d9f70ad45d2a95ac8cbce7c1d5f892e326484858dfd5fc8f
TLSH
T137C02B0C0F9A0725F04403BF0130D9021A20DB06F28BFF0F0FB12A980566F321810CEE
MD5 SHA1 SHA512 TLSH

Submit Download

8B3C0310C2EA810C48E449EA75059E8A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B3C0310C2EA810C48E449EA75059E8A
Size 248B
SHA256 4194195580bf6cf97184b88ff07ca8a7f41a1a119e8e134305806f33b964f2ad
MD5 13be0340634a1ea025b9f3c9c344e480
SHA1 d54053cf01079bda25f642513af7a7f62a7a6685
SHA512 cb8f379c3b84a36863d7d71342a2ffb4c7717da6eca6cd24e402004cf5861c290d9b55a46fa4f182eced95f5b96edeef2fc5b8cd2c7647094fd5e99933381093
TLSH
T1DAD0221D23A22216F07C833289918E1AAB312102B4E08B06093A130DB856E132C23C0C
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_8e9a5491c0ca699c490b8048310f5225_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
SHA256 db9feb1875716afaddbc034729342caf8cd03d00b638031abefef51665e21d74
MD5 8e9a5491c0ca699c490b8048310f5225
SHA1 6a7934a4ea3ba7af4fdfcb62c1bffa5d9f02d578
SHA512 2a1f8f46adc00e32d39cae64d80c73c6f477882e6d6b4d6a985f5bb8ed659e72dc13fe721b62962ffabeaadabb0410a31bccafaf04abdfbf5a88effc8189db62
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXC:GDVqlzYxGBcslpiuWXC
TLSH
T1C3947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1A74.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1A74.tmp
Size 152KB
SHA256 a8d1a293e16b2554345f76fbc511ee896204b0ba7ce590e4aea4be950fd2d55b
MD5 0623ac4453e11dacb7e27664a825804e
SHA1 8119784541ac11c8c6f236e95da1ffd2e8e8b49d
SHA512 581e7f2fbc81f4c74c9c09cc2650385a30d1d78636c128bc3fbd193cb9f69d8a39d05f96a52117c2791739a295566ed8dbf962494434b8c0dc9a4597ed29566f
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMPdnj+CB5XIYNQp:ujuDOhVLA0dnj+CPXIYw
TLSH
T1EBE3481136D1CFB5E1AF44318DA25AA44BBBFC325D7297DB53903E0D3E319418A2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 78b24eecad5149f76fa62fa97cd271eb5bc40fd96d733f9c7f66ce260600b2c2
MD5 8456b26d08f4affd22db1e379de58be1
SHA1 8f6e6e89bc53a86f07542c4c2ccfff39fdfff803
SHA512 a6e1a46d7fd604ecc0512e689e6ec86d42f9d62695a9d193f77a23e1f5b90fa79ddd114231de3ef06ff5caa0b383e0c30b30ecd48b1fadd14815350081d049bb
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6Pdnj+CB5XIYnQB:GjuDOhVLOdnj+CPXIYy
TLSH
T1CCE3491232D1CFB9E1AF45318DA29AB546B7FC319D3297CB13907E4D3E359418A2A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5140-70-0x0000000000670000-0x000000000069C000-memory.dmp

Download

memory/5140-126-0x00000000020F0000-0x000000000211C000-memory.dmp

Download