ddad5514f15e2daaee2500d7ef3953cf77ec7fb4c5005a08c54f8e93332154e1

General

Target
2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample260427-ftfjasb15w
SHA256 ddad5514f15e2daaee2500d7ef3953cf77ec7fb4c5005a08c54f8e93332154e1
MD5 7b3e30f001ec023ec99aaded84945fa8
SHA1 23dbbafdeae1a93af3717149671eb5609b3e7b20
SHA512 0c04af7a276686bd9eaffcb97845aab02ef5804a979525896f9648a1c39e8e269bf6e5b7d583671ccffeb19eacd359f70d9d516b0f4c3e5e9ad4540114e1f26d
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWX+:GDVqlzYxGBcslpiuWX+
TLSH
T11C947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5024	armsvc32.exe
700	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1508	5428	WerFault.exe	78
1724	700	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
700	eventviewer.exe
700	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 5024	5428	2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	79
PID 5428 wrote to memory of 700	5428	2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_7b3e30f001ec023ec99aaded84945fa8_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 1552
    3⤵
    - Program crash
    PID:1724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5428 -s 1892
  2⤵
  - Program crash
  PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5428 -ip 5428
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 700 -ip 700
1⤵
PID:5364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 203KB
SHA256 8bb93568c4a8a8ff6241a5421ca587bcfe375df314a6b2f2caaa3afdbdb5803b
MD5 16542841f9a8d23905e48f11b5977da6
SHA1 02b5607386586238222c0d19ff6ed91a8aad450e
SHA512 7050c6d5a2756b0d47cb6e44970c28d04a5cba9bab8af2691eab3bbc38d9337815ac18c7c7d9b8104a1b1881f22715d8f51aa566f148b1f395d67aabc579e4b1
SSDEEP 3072:EXdu1KMx5NTxjGjOLaeEmUiCgaXZ1s1+5Nd5LC:EXwgMbjGPF7tLC
TLSH
T19E142A686C77F061BCA99EA24DD99A9A63E7BDF51721074F0E70BF502C03A9BDB57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f8f8bb95fa96d9917c04aedaa155a5af8af69bf28f4d48ac82c486695c6d6068
MD5 079af5b6a0893bea1dd1215a4a07bdf1
SHA1 b13ba388e7b11f2438df8e78e0e1c708445bda47
SHA512 a74d85ac70bd8eef67d007b44b6498e4ab629c86151e0a607236a144316e20634e0249b6bff6d62d344767e060793e7a068d0214a758e18a62a930663693badb
TLSH
T185C08C080E9A0229E08403BA01208A021A909414E28BFF0F0EB52A584565F221A20CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 41ff94e5a0cab55f3803bb8962dc5664464c7995a6bd2192e7b7ecc1fc16b9a8
MD5 f9ba7b7b2a8b9345b97436780bdc5295
SHA1 5bf2fa2f585ef9e3ba028786ec076ef855b917e0
SHA512 6020b216f5d9bb5d20c5fedd784f4333ef1cbb2eeb66b693dcc0b5e513aaf0affb5d4acb874c8bb480738fe8b2fa41444a92a41f9609e1ec6b8dc3018f739d15
TLSH
T149D0222C2F002737EDE1C73988A0C818B712121274A1CF0908A6598EAC236821C21C5D
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads