d6981f9fc504b2656f5233380d8bfbe0847088cfad249faf30d48367da7fd8f0

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 454KB
Sample260423-cfmtnsf161
SHA256 d6981f9fc504b2656f5233380d8bfbe0847088cfad249faf30d48367da7fd8f0
MD5 5cbbbe6988e0a921ddf62f2112bc55f4
SHA1 47bec440015f33645174294343e6111c4d112380
SHA512 aab9b03e6e5af94631c19fae49c9e5b46d0485ff5e6b7c3606b09af0a5ae075b3d202c3418b8c32dde18bfac80aeaf98a74d9d8d0e6fbb83a5b8351bced5bb46
SSDEEP 12288:GaoVmp+84YntqSya7Id2RrZmRz6FeKwBx+UafFy9iuWX0:GDVmpzhqSHTmRehwBxRaf+iuWX0
TLSH
T17AA48D1175D18EB2E5AF043049F59E759ABBFC300E219BEB63947F1D3E30A818626763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3524	googleupdatecore32.exe
2092	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3264	912	WerFault.exe	80
4864	2092	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdatecore32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	eventviewer.exe
2092	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3524	912	2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	81
PID 912 wrote to memory of 2092	912	2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5cbbbe6988e0a921ddf62f2112bc55f4_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
  "googleupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3524
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 1556
    3⤵
    - Program crash
    PID:4864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 1432
  2⤵
  - Program crash
  PID:3264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 912 -ip 912
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2092 -ip 2092
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 205KB
SHA256 a546a0276b0c41a762865fd472c5e91fddbcac221ec0de37038024ec510216e9
MD5 72894ceab3f82974831cef9933628204
SHA1 479b2ef27f6d49fe3561ba7b545f57cba5a6efba
SHA512 cd652abe90cdb9d6c45291eb5f5768675aa3ac751911ad3c0cd858223b441157e372fa4038f85f48b703e2c09e703ff02367e322606dd326e2b166187e9aec1c
SSDEEP 3072:rcXdi1Kax56f+FoNdVa0dm0i8zjXZx1PZ4mQw31:rcX8gaHFox34y31
TLSH
T179241A686CB7F061BCA99E924DD99AAA63E7BDF51721074F0E70AF502C03A97DF53400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 63f1ccc7e9024505c1533d550a8afb32126488a60c7e37f03d5462a1dde38c42
MD5 1e7aad3daabf9cf837f547bc2d195951
SHA1 fee169df3f63d5ba6c85b6a0b734a4ae965baa89
SHA512 8ff7ba216478e15e733a381aedce5d9de4c6ec7b1c120be0c70474714e6cc3500cc6b774022c777c2d0bd1dc183f26b1b2631b84fa02f0d930b404d3abf8893f
TLSH
T174C09218AFA70326E14907BB95220242A990A601F2D59F0F05B6269A5A62B122920EAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 038e218e9bbb36798e8eeeb54714d45bb148017538c49e3dbf2b3d3a75c1d101
MD5 555a1f2eabc9401332e2ec76ed0554a6
SHA1 d27b628617c7835097aadd61408632e8d0eda898
SHA512 f2769d0a45fc448d93a9523c5e7925020cb4bd15ba5dc30e274a4f718700e468fdc6cdc445966da2975ea77c086741b5488c9580fb75ab97b10a9ab6ce34713c
TLSH
T1EFE017112AA84204E9770A3CA873A549A97AB76A6A51CADD0275008D5C32F628932719
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 72d15d97877d87f242d59b2c350f036c5d8698ed78f36d910d0dda2900045bb1
MD5 2f08093922051435ec5a70cf1bc050d3
SHA1 cf89740ea15d6f69bb42e1384f6e128022f840b7
SHA512 723164af0fcb807667d7f92b82dfdc85143bb8a7a2649e596323ba4cf12fb42f1d3ca8ee942934134f1a279f006c27beffaa76799d2a4ae82f78b5b5b66725d9
TLSH
T19FD0802C0F60027AF569C635D430014159A17753F0E15F4801F0554C5467D733C11D06
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
Size 217KB
SHA256 25ba4af76f5bfdedbc61cc97dcac8bb6b4ba5e53b50a7566be429cdec61943e8
MD5 078739434d108cd973d5d10bd9f01c10
SHA1 a57866bc0eb819b9626fec9d20273500ba2a0b92
SHA512 773ef977752792a19a050bf7fbd5f1b0f5cd349818e6f1cc591192bb42268bd8a0180003f66540f668fbe5e7286880787fc5a95839ea6522a37e3092575dd82f
SSDEEP 6144:fMtqSya7Id2RUSZmRi1Qye6AO/ebGwI4fx+U+FfFyj:EtqSya7Id2RrZmRz6FeKwBx+UafFyj
TLSH
T1E0248D12B5E180B3E9B3093409F4AE759ABDB9310B258A7F63D84F6E1F30681D216777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 104KB
SHA256 0a6b0061c4a5cd0aa1f8510d92edee2015a4f96dece93cd99bb44ea5493178dd
MD5 d2686d0b536412550fd3533778a839ce
SHA1 73eb71ab734cb1377b3d68bbcbafb6a695fbed6a
SHA512 49d90fe90c413af11e87a1048415296b1e7fd7fc0ccfcca1fbac4cc0410d34fb1e16409d750be303a4adc6de95e60eeb77bb60bd1e55933ff21610714ca5afc1
SSDEEP 1536:6Jqwy75UhaasJY9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:ZDwdXphLMZ+tH
TLSH
T156A32A7163F00ABA60C343A47B647A597E95D18BE113C0DCB3BE56516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download