af9a707424b1bc101d952bb47b098fe56b8e217ccabaa965e5cd13ee9ea9c921

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample260503-erfkvae14n
SHA256 af9a707424b1bc101d952bb47b098fe56b8e217ccabaa965e5cd13ee9ea9c921
MD5 b293742edf87ce7757ab489dbfbe1593
SHA1 c7eeeef972e601db7d634c31d15bcc9ef102b607
SHA512 3bd10045bc3813ee135af52da189895e274fec4759d63febcc866f07d88ff74adc6e815e2b3aad9f13d76207ffe8b21817b3023737ef4fe0719667d1179ea725
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXW:GDVqlzYxGBcslpiuWXW
TLSH
T1C7947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2992	armsvc32.exe
4724	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3512	4692	WerFault.exe	78
4732	4724	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4724	eventviewer.exe
4724	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2992	4692	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	79
PID 4692 wrote to memory of 4724	4692	2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_b293742edf87ce7757ab489dbfbe1593_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2992
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 2028
    3⤵
    - Program crash
    PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1912
  2⤵
  - Program crash
  PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4692 -ip 4692
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4724 -ip 4724
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 211KB
SHA256 429feaa24bba2fc61fec147a5a03d7e19b36558f6df9e4f571d930346d965fbb
MD5 74db0cbf14f21c02d594be2eed4a149a
SHA1 32ab56f361c88cc4a9315640e86bd56f3b322854
SHA512 a4af47a18b6df11ff4c0217afac39cc208e7caacbe2ecdeca75b1f831b7a8a4ebba66c7d74045a2c3911ea48c6813ad3971bc6af63f065d0c7f23eaa54e4bcf7
SSDEEP 3072:6Ei8x53iu5LVa2F2cTSs9iv+pXZ3dETaGUlLmfe:6P875LU2U81lLKe
TLSH
T1492419686C77F061BCA98E924DE9EA9A63E7BDF51621074F4E70BF502C03A97DB57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 22a33f93fc635eb75da25e466562bb52bd9a7c8bb8ba4e7db98f600067291da1
MD5 da93a8df5176620ea8c67a699fa8d196
SHA1 5235966e872dc3604beb491f6fe586e7b430d0e2
SHA512 c91d6b352038677fe2607e24ab04ddc4bee328f7bb256188bc992b32c502885bf8d5030b626489bcd1b6688101b06643fe7ac649c3573df2900e67eb011335e8
TLSH
T168C02B0C0F9A0326F04443BB863089031A20D404F28BFF0F0FB13A6805B5F311810CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 210e5a95bc537845c109fe01d15b74333924418b07271dc4e959d281023b7bc7
MD5 fd5a8931370648b4ac550d8d2ef6c8b2
SHA1 dc59da313f17dbbd9067ab5e602e63c4961bc54b
SHA512 2db02c2fecd7b7f6fdb1c6df0f903732823b5f69a4f009f797c27be7c74a0fc70294b6ff3131d612bb7dcf14e58ffaa3921bd5500b0aab7b3444b09f38e22c5d
TLSH
T1BEE05E116BE80204F5770A3CAC7366499977B76B6A51CADD0279008D1C21F62DD76B1E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 2d32ca7917829b080909f41466227e3b5ffd4a90d1b793b54499dba4951238cb
MD5 77669b8fc06afb4d7bf1f5740ba97001
SHA1 a0c81c3d28b1050de24711e9acf58ec9c0f2cb38
SHA512 e12b9eeff25a28968b5420c5fb7acf3155bc866adb2522b712379d99c6f54aa685d2a76f65edff7d952c35d22f126a0f88ed03a78fc5443a1c249f4eb8b7b05a
TLSH
T17AD0220C0BE20367F068C2B5097982028BBA3111A0A1D38901B28E696C20F923821F0D
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 053659d203c3457830b333b3497e4f173ed16c4396bff02154f95393f11c3b3e
MD5 669f5e0138150353180d2fdea93f6e5f
SHA1 4690cc67d939a4bd5a603bb6b804eecf309c0fef
SHA512 b8e9573edcbdb70eda989bf51f19353b0d808838d398d8cc5269d876c733131728d62ad1394414310d83275ba2b11d011e85b712aa1f5562a2ee05a235c7f992
SSDEEP 1536:NJqwy75UhaasJD+yL9FOQpbHtpxwkTPPnOED4LZFasOtN9WlQH:+DwI5XphLMZ+tH
TLSH
T1F8B32A7163F00ABA60C343A47B647A597E55D18BE113C1ECF3AE16516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2992-28-0x0000000001330000-0x00000000013AB000-memory.dmp

Download

memory/4692-27-0x0000000000AE0000-0x0000000000B5B000-memory.dmp

Download

memory/4724-29-0x00000000006C0000-0x000000000073B000-memory.dmp

Download