a5e08db70d58e2aa723a309a9abda0e3594e813e1de59189eef0a2a9afd4fdd9

General

Target
2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample260427-e11x5sby3x
SHA256 a5e08db70d58e2aa723a309a9abda0e3594e813e1de59189eef0a2a9afd4fdd9
MD5 4a85777103080da3135635caa2118a6e
SHA1 d56fff4645d0fb5b0c7302e0e9c97978ae0819f7
SHA512 7755be9865b57a906f164636599d1581e6ae7cc8bda0b0da8756be9f95e2e8b8e2c5bba4e2d20a0f60085f43c156ee2c73518f5ac3569a21c18646d809cee745
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXt:GDVqlzYxGBcslpiuWXt
TLSH
T13F947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2292	armsvc32.exe
3780	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1916	3780	WerFault.exe	84
2096	4448	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3780	eventviewer.exe
3780	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2292	4448	2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	83
PID 4448 wrote to memory of 3780	4448	2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2292
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 1320
    3⤵
    - Program crash
    PID:1916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 1324
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3780 -ip 3780
1⤵
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 4448 -ip 4448
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 104KB
SHA256 f2c60894b1c486a8fb7e8058172b0994b7c65d0ddba891d024821c3bb1855097
MD5 9282833cbd73342fb40bc2c60e6415ea
SHA1 7f183f824dc23fb98afb2b987522849d188fff5c
SHA512 32dbb75e960522c8931ed74656571b5ded9c83ecc807cd49e96cdeec0ca7a26676feddff9d00c34c89c10a68a4ab206ca4c4c1bc5317344034491f7e2d88154b
SSDEEP 1536:cJqwy75UhaasJw9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:vDwXXphLMZ+tH
TLSH
T1AFA32B7163F00ABA60C343A47B647A597E95D18BE113C0DCB3BE56516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2292-18-0x0000000000EF0000-0x0000000000F6A000-memory.dmp

Download

memory/2292-31-0x0000000000EF0000-0x0000000000F6A000-memory.dmp

Download

memory/3780-16-0x0000000000540000-0x00000000005BA000-memory.dmp

Download

memory/4448-17-0x0000000002350000-0x00000000023D7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads