af9a707424b1bc101d952bb47b098fe56b8e217ccabaa965e5cd13ee9ea9c921

General

Target
2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample260503-erfkvae14n
SHA256 af9a707424b1bc101d952bb47b098fe56b8e217ccabaa965e5cd13ee9ea9c921
MD5 b293742edf87ce7757ab489dbfbe1593
SHA1 c7eeeef972e601db7d634c31d15bcc9ef102b607
SHA512 3bd10045bc3813ee135af52da189895e274fec4759d63febcc866f07d88ff74adc6e815e2b3aad9f13d76207ffe8b21817b3023737ef4fe0719667d1179ea725
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXW:GDVqlzYxGBcslpiuWXW
TLSH
T1C7947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3204	armsvc32.exe
2908	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2272	2908	WerFault.exe	88
1668	5804	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2908	eventviewer.exe
2908	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5804 wrote to memory of 3204	5804	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	87
PID 5804 wrote to memory of 2908	5804	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5804
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 1312
    3⤵
    - Program crash
    PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 1148
  2⤵
  - Program crash
  PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2908 -ip 2908
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5804 -ip 5804
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 211KB
SHA256 429feaa24bba2fc61fec147a5a03d7e19b36558f6df9e4f571d930346d965fbb
MD5 74db0cbf14f21c02d594be2eed4a149a
SHA1 32ab56f361c88cc4a9315640e86bd56f3b322854
SHA512 a4af47a18b6df11ff4c0217afac39cc208e7caacbe2ecdeca75b1f831b7a8a4ebba66c7d74045a2c3911ea48c6813ad3971bc6af63f065d0c7f23eaa54e4bcf7
SSDEEP 3072:6Ei8x53iu5LVa2F2cTSs9iv+pXZ3dETaGUlLmfe:6P875LU2U81lLKe
TLSH
T1492419686C77F061BCA98E924DE9EA9A63E7BDF51621074F4E70BF502C03A97DB57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 21c28f1cf4fbfe619257ad11b11a380a31c236291b07aa97d769e241173b9dcd
MD5 3d7d9148a30d4db9efd6b780aa6547b8
SHA1 ad6008c8e168cffe80e3126b17967852f895eef7
SHA512 20b0343aa5852aac565aa8253fadc8f335eaef41a1e768ecea1e8a78a9bc572d0a65fa342de757aa14588a3a0771af642c1d55150e6a26f239fe032718ece864
TLSH
T16FC02B0C0F9E0325F04403BB017089031A10D404F28BFF0F0FB12AA90565F311810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 f92a33d75e78b436c7fc38d40d6aa2cfbb20982d988205748849a349d6be2602
MD5 395ea254adc662781468804b2f78df83
SHA1 2538adeee90f85647c57d866e776576f29dac4ba
SHA512 306c0ef273f1dab0fba7922054ee3a45f750377552b0cba7121d6f754a36a9d39890f34fe104b6910d3fed9e2640179f23c2d78dac6ef9c3b70fe7dc0ca25d9a
TLSH
T103D0220C0BD203A7F068C6B5097982028BB93111E0A2938D01B28E69AC20F853822E0D
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads