ef234ac25df72a96a0ca4a51dd6f809be12375669651da6a7c992b9ea4b1e0e8

General

Target
2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 454KB
Sample260511-cgp1esds5p
SHA256 ef234ac25df72a96a0ca4a51dd6f809be12375669651da6a7c992b9ea4b1e0e8
MD5 7a99100da340db1cfd9a11744f872e37
SHA1 d74401a1c76637fdc3aca97bebe4aa049c687e88
SHA512 4c1a1c6793cde07a0a367989bab450f157606ff8369d05e4fe47067866bd23035e7566937aa91a62c264c07136d27c31a9ee72de9f9790251dbb18e4f708ce9b
SSDEEP 12288:GaoVmp+84YntqSya7Id2RrZmRz6FeKwBx+UafFy9iuWX5:GDVmpzhqSHTmRehwBxRaf+iuWX5
TLSH
T10FA48D1175D18EB2E5AF043049F59E759ABBFC300E219BEB63947F1D3E30A818626763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4528	googleupdatecore32.exe
4168	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5108	4456	WerFault.exe	82
3152	4168	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	googleupdatecore32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4168	eventviewer.exe
4168	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4528	4456	2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	83
PID 4456 wrote to memory of 4168	4456	2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_7a99100da340db1cfd9a11744f872e37_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
  "googleupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4528
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1684
    3⤵
    - Program crash
    PID:3152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 1592
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4456 -ip 4456
1⤵
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4168 -ip 4168
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 eecacdcc0750642ea8ff41a2c87bf81756e13fe6f0d4e67baccc41b9d494e190
MD5 82e2233d69f900e3d3438cd2e62d4cfc
SHA1 dc77421d722f58f2be20bf4716e62a6a1890873d
SHA512 2a4dd251684317e6d257c60097383f23e329ea5381ad63c2a7af9f1bdc4adf4c977bf07d51c669ca30d6ff7391e7bb96462777d87866f0aaa6f235630d025839
SSDEEP 3072:yb5oiaFrgqmpK92MZ/PXV+gX8eP6t7EmMHpZJXM:yYFrQpcnQiHHJXM
TLSH
T153244C68AC77F161BCA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97DB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4550717686d7bdf8bb2571ddaf51a104fa73fae652a71ddb58501357a5e17471
MD5 361f51cd4ee80465870aadba2e7d7089
SHA1 c5270445bd6a01e763962c750211ac7c4c556b77
SHA512 0ce40af39cd5a9014c91d34ba03a6bf9de87381e06914d1d877c524225ade577d4b896a86345b143899629241954cbb7482c6fced33422cf73cada845a5d2db3
TLSH
T1A4C09B1C5F570325E14507BF4121114159549501E5D56F0F04B625584562B511911E59
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 84d1b77d4fb458b7c98f3622ea79e9f33efb4af188fac30f3664f7fa6752ab7f
MD5 ad2fc06cceed979bd37ebfd57e09da6b
SHA1 012c2d5a8e105fbda11ac45827413889d68dc5b7
SHA512 02de87eac36aede701daaca980ab7aef0243fe1d3ff43a85e837ba1bcd7d7be8d44a9e67ff1798b424e8dec55a898c23ad2e3789ae7f14156cc2c412454c2df9
TLSH
T100C08C1C0E9A0225E04507BA0120A9425A109404E68BFF0E0AB22AA80565F611811DAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 e27f272929bdd4965cce9e0278b4c487f8f82f66978f88f669a5b7e1a701f2a6
MD5 90d52810aa54aaf8a637aaa6ad61aaaf
SHA1 3929a31dd886831ecf076228192a5b1d790ed49b
SHA512 ffa08b80162972fe363cac1f9566edcdde2089752818a157ae8c9be97f6c19c6708d504ad7b5f3abfc936849c7b3dde40a4932c499edb18f40bb884e9ac5de29
TLSH
T11BD0122D5FE1422AF114C339E8B7C5166D52AA63A2B14F8D02E589186C7BF217D11D14
MD5 SHA1 SHA512 TLSH

Submit Download

googleupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\googleupdatecore32.exe
Size 217KB
SHA256 25ba4af76f5bfdedbc61cc97dcac8bb6b4ba5e53b50a7566be429cdec61943e8
MD5 078739434d108cd973d5d10bd9f01c10
SHA1 a57866bc0eb819b9626fec9d20273500ba2a0b92
SHA512 773ef977752792a19a050bf7fbd5f1b0f5cd349818e6f1cc591192bb42268bd8a0180003f66540f668fbe5e7286880787fc5a95839ea6522a37e3092575dd82f
SSDEEP 6144:fMtqSya7Id2RUSZmRi1Qye6AO/ebGwI4fx+U+FfFyj:EtqSya7Id2RrZmRz6FeKwBx+UafFyj
TLSH
T1E0248D12B5E180B3E9B3093409F4AE759ABDB9310B258A7F63D84F6E1F30681D216777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4528-8-0x00000000033A0000-0x00000000033B8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads