fd187d717c54d78882e9774e282c66b88ecbef63458ba25f95e6fba7042fe376

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260511-ck4b8ads9p
SHA256 fd187d717c54d78882e9774e282c66b88ecbef63458ba25f95e6fba7042fe376
MD5 91e1911b7d94a811ffd5a674689ab733
SHA1 c6ae0f8605937f07f5db13c7989afd76ebd77324
SHA512 ae00b9e71f655d005fcfa30cf6e882b076d92f01b863e14f18a54f6b60b841a54b635ac800251628191a4b908fb6440828bfb27ced8d981c3cb9c8a86664930d
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXJ:GDVLa5S0vHyyLj8trn3wsliuWXJ
TLSH
T1CFF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4136	jaureg32.exe
2932	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe
2932	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4136	3852	2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	80
PID 3852 wrote to memory of 2932	3852	2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4136
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 eecacdcc0750642ea8ff41a2c87bf81756e13fe6f0d4e67baccc41b9d494e190
MD5 82e2233d69f900e3d3438cd2e62d4cfc
SHA1 dc77421d722f58f2be20bf4716e62a6a1890873d
SHA512 2a4dd251684317e6d257c60097383f23e329ea5381ad63c2a7af9f1bdc4adf4c977bf07d51c669ca30d6ff7391e7bb96462777d87866f0aaa6f235630d025839
SSDEEP 3072:yb5oiaFrgqmpK92MZ/PXV+gX8eP6t7EmMHpZJXM:yYFrQpcnQiHHJXM
TLSH
T153244C68AC77F161BCA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97DB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6e08ed62007a43d14c4c0a7c0e9079a6ef793492d84a478ee8ccfd3fa6247f15
MD5 1773ea8fce457b7c4fee9571357a1938
SHA1 a636d86a34740a01b6daf97d8e25a624bc3ac75d
SHA512 9e1b891850510e31263f471ba16096f16daca7f63080dc10ef6210db809f32d938094e58b4000d8f4885464d45943274c9b00da1f70e2675fe80e6b9f25fc2e1
TLSH
T1C7C09208AF660336E14A03BFC12103425950A501E6A59F0F04B636584A76B122D20EAA
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4896651463430ea42d55c6c4221ec69706c9b26a5307968bbf1c8629c8200c8a
MD5 a6c74ed18233340bfbdd5dcdf23caa58
SHA1 8a539c67a3673e19f01a89faa3cc481624811bae
SHA512 7347edb095f7491db86c3b4e82f4ac8d44c5757eef0bd50601cb6084758ab6cbec347ec90605d69e37000f12012c147a02bc0508cf216f4759673a9db24e1695
TLSH
T10AC08C080F9A0225E04603BA81208A021A109404E28BFF0E0AB13A580569F211820CAE
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 fd5776416453cbe68d0d6af1a67b3106f66da9b5f48632e363d9495f41d7e158
MD5 dbbcd1c83dfab875f1d5edf1f5d682f9
SHA1 6c4d4c3c1816d4b227e3eaf424c9224ca3adf90a
SHA512 a9f6bfb8ee5a6b2fe231f51329fe8f20c65503b9e052cf344b76e707cb8ab98cb1dcb6a27b5e68f469e973c661e176e050e2dd4e70aac5f7b6f00b6a29762a7a
TLSH
T131E05E122BE80215F6770A3CA87366459D77B76BAA51CADD0275008D1D25F61C932719
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 eb7917b62068e54a38b74a71a712d8494977e47ecf270fca65b18be7fa055901
MD5 e108fdd744fbac10effefc836e2dbc31
SHA1 57d7feaeef3e18894a98e908037531043f024eb6
SHA512 8bd1a69d355af846211fcccd1b1768040977cfda45d04bded53b5fb6f9c954068256ab8518618e91346a60aa1321e944c19c075235bace6396e82adf27f7cb3e
TLSH
T191D08C2E5FA2023AF118C33998B342451D82B923A2A0CF8E01E44A0C6C7BF023E21E14
MD5 SHA1 SHA512 TLSH

Submit Download

2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_91e1911b7d94a811ffd5a674689ab733_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
SHA256 fd187d717c54d78882e9774e282c66b88ecbef63458ba25f95e6fba7042fe376
MD5 91e1911b7d94a811ffd5a674689ab733
SHA1 c6ae0f8605937f07f5db13c7989afd76ebd77324
SHA512 ae00b9e71f655d005fcfa30cf6e882b076d92f01b863e14f18a54f6b60b841a54b635ac800251628191a4b908fb6440828bfb27ced8d981c3cb9c8a86664930d
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXJ:GDVLa5S0vHyyLj8trn3wsliuWXJ
TLSH
T1CFF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 236KB
SHA256 51a18cb8cbaf403b8711b40de91fd0823613494c772e9e6af14261abb9018c92
MD5 8c033bccb7b4d8e7200c391e56f00d58
SHA1 d21e77797ed226cb407551cf58e34c66cfaa96ed
SHA512 e2c946d672cf0e73cfcf8281c6ae69fbd3218c2f23bd570916cdd6a38aa7fa4fd28c781c89e2fe1b1c41ee1c4a12fc409be06c64d2b9c3bed144fc6c8f173336
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQbiYV0OZNjrc1F+QUQoRlMa:GjuDOhVLPfnOsUXIYdiiuW1FXEl
TLSH
T17A34AE1136D08472E1B905314C76AB79C77AFCB45B318687A764FF9D3C34A808E2A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 295d42622eaa9a87aa3825f696c9b6bc29d1eb8e17d3ec657e48388c61dacc4e
MD5 25b303fa513b5f83e0139c9035050912
SHA1 eebcbdb9f68bebb2c75093129bbb188e189a8917
SHA512 509ef53730ff4aa426ec53342312104a951b2bf0fd7657d7b6afc556aceb1b01e1ea668c6499a783262ae6a3351bf7ad45f8ba7cd8cefbd5b5404b6775739666
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQB:GjuDOhVLPfnOsUXIYds
TLSH
T14FE3AE1136D08477E1BA16314C37AB65C776FCB59A72860BA760BFDD3C349808D2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download