Overview

overview

7

Static

static

3

2026-04-27...er.exe

windows10-2004-x64

7

2026-04-27...er.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    27/04/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
  • Size 405KB
  • Sample260427-e11x5sby3x
  • SHA256 a5e08db70d58e2aa723a309a9abda0e3594e813e1de59189eef0a2a9afd4fdd9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-27_4a85777103080da3135635caa2118a6e_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
      "armsvc32.exe "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4716
    • C:\Windows\SysWOW64\eventviewer.exe
      "C:\Windows\system32\eventviewer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 1476
        3⤵
        • Program crash
        PID:1824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 1440
      2⤵
      • Program crash
      PID:4912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5100 -ip 5100
    1⤵
      PID:4800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2512 -ip 2512
      1⤵
        PID:2244

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            103621DE9CD5414CC2538780B4B75751
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
            • Size 734B
            • SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Size 4KB
            • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            94C33D778ADC562180302FF1B77EFF1A
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
            • Size 203KB
            • SHA256 412c488240f9e3c4776417d2aeeb36d2e4d322c6a6b6e6c50068a798835b5da2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            103621DE9CD5414CC2538780B4B75751
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
            • Size 192B
            • SHA256 fda2d29a4cf6b6e8e0abd3b0e02f92e1e4c00f0cedd975a96dd10d419f104492
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Size 342B
            • SHA256 559cb2ad36565c2f42ac31de15568f920d36617411c18f019821f934782a2288
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            94C33D778ADC562180302FF1B77EFF1A
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
            • Size 246B
            • SHA256 cb454fbf624bcc1cfeef4f4e4765b1f264371ec96f112b19cae6d94016d50c8b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            armsvc32.exe
            • Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
            • Size 168KB
            • SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            redevlist.dat
            • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
            • Size 104KB
            • SHA256 1c64698c6ddd2cb3d9f51117316f491e9b4a46e724985ee2f01a80668598c417
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            eventviewer.exe
            • Path C:\Windows\SysWOW64\eventviewer.exe
            • Size 88KB
            • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2512-28-0x0000000002EB0000-0x0000000002F14000-memory.dmp
            Download

            memory/5100-27-0x0000000002ED0000-0x0000000002F34000-memory.dmp
            Download