Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
- Size 596KB
- Sample260425-vn5zbsew21
- SHA256 72b0714874835b32c1c02c027690807f0a817cce281705a7741cc9f2830e44bc
- MD5 49ca4d26ee4a15924fb7a5a7ea59495d
- SHA1 f389e8e55fd2eea5c948251fe397f2a6dcac837e
- SHA512 5b75f6fc08847f3db0f7bced9550d813484ea66dbc0f68c2aa3f27314d6a9678dd5949c44873a5450488ad2c7e145b5b7805cf8d3e8fefa291f6a8ba5b618e58
- SSDEEP 12288:GaoVmp+84YWE+66uTHJ/J+kvvcLIb1M/Bo1lBISiuWXu:GDVmpzywxx+1L6goLGSiuWXu
- TLSH T106D46B1176D0CF31E2AF053699659AB85A7FBC208F2087CB63947E1DBE306C19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation adobearmhelper32.exe - Executes dropped EXE 2 IoCs
pid Process 996 adobearmhelper32.exe 3488 eventviewer.exe - Loads dropped DLL 10 IoCs
pid Process 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\java\jdk-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\7-zip\7zfm.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javah.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\wsimport.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\klist.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jinfo.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jstack.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\pdfreflow.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jconsole.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\powerpnt.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jp2launcher.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\policytool.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\integration\integrator.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\msqry32.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\appletviewer.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\tnameserv.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ssvagent.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\servertool.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\tnameserv.exe eventviewer.exe File opened for modification C:\program files\7-zip\7zg.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\iecontentservice.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msosync.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\namecontrolserver.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\addons\onedrivesetup.exe eventviewer.exe File created C:\program files\7-zip\uninstall.exe eventviewer.exe File opened for modification C:\program files\internet explorer\ielowutil.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msoasb.exe eventviewer.exe File opened for modification C:\program files\7-zip\uninstall.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\mavinject32.exe eventviewer.exe File created C:\program files\common files\microsoft shared\vsto\10.0\vstoinstaller.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jcmd.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\misc.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\unpack200.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\jp2launcher.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msohtmed.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\mavinject32.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jabswitch.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\msouc.exe eventviewer.exe File created C:\program files\7-zip\7zg.exe eventviewer.exe File created C:\program files\google\chrome\application\chrome_proxy.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javadoc.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javah.exe eventviewer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeARM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adobearmhelper32.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3488 eventviewer.exe 3488 eventviewer.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 996 adobearmhelper32.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe 3488 eventviewer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3792 AdobeARM.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4324 wrote to memory of 996 4324 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 84 PID 4324 wrote to memory of 3488 4324 2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 85 PID 996 wrote to memory of 3792 996 adobearmhelper32.exe 86 PID 3792 wrote to memory of 6024 3792 AdobeARM.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_49ca4d26ee4a15924fb7a5a7ea59495d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\adobearmhelper32.exe"adobearmhelper32.exe "2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"4⤵PID:6024
-
-
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 782B
- SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
- MD5 29f1b2d1b6f9290138596cf180847e53
- SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
- SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
- TLSH T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
- Size 18KB
- SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
- MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
- SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
- SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
- SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
- TLSH T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
- MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
- SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
- SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
- SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
- TLSH T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp80D3.tmp
- Size 3KB
- SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
- MD5 bbb796dd2b53f7fb7ce855bb39535e2f
- SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
- SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
- TLSH T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp9836.tmp
- Size 3KB
- SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
- MD5 ec946860cff4f4a6d325a8de7d6254d2
- SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
- SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
- TLSH T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Tmp9837.tmp
- Size 3KB
- SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
- MD5 fc2430057cb1be74c788f10c2d4540c8
- SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
- SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
- TLSH T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\adobearmhelper32.exe
- Size 359KB
- SHA256 13071ed7a910011edced1a33198e6bcb3580f659bc48ce6bf3dde47f63d1e744
- MD5 3f9c7fb6c9a66e926a2eadf5f33b3806
- SHA1 57f127bfe8eed615aafa7e739ec864da7b042804
- SHA512 6a09324d34b06a5465615b54b4c4f0570eaa2ec64b7b376beeb8ef16402a7e96079a793508e018093230d044a714ce7e23093d9eaa38c6250e046dbfa9a849c1
- SSDEEP 6144:auSkkTjzhZ2opkGe6vyuTHfx/J+kvuuHcLBuiyt1M/VvoF3mvwBVObdu:ZE+66uTHJ/J+kvvcLIb1M/Bo1lBIc
- TLSH T194746D017790DF31E6AF05369D6996B45A6F7C208F2487CB23943E2DBE306C19A35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmpB6B5.tmp
- Size 152KB
- SHA256 dd0dcfbd09b2790b96d4c6f85b8b885cd356b4b19805f08f52b9e483d64ef9be
- MD5 f63476e84188b9afa3ebb70394fa09bc
- SHA1 5e3c275b9ac75acd88f27d32ea7ccfc8a8507e57
- SHA512 992a91a323b9ad5fdd8917ed8e1253a3e952d6f863fa57d01daa327296fff7e6604f2e036ea434a2c9a0eb837e3e0d692c8efef0cb4c4c6188cf684cc42cb1f1
- SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nj+K35XIY3Qp:ujuDOhVLAo5nj+KpXIYq
- TLSH T1EFE36B1332D18B75E2AE02305CA1DBE44AB6FD311D33766B77507F1EAD32904AA16763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH