40b6763bf4afc5522faf57e0b444379866dbace2768dcc265314f6bf41406db8

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Size 494KB
Sample260511-cngbvsas4v
SHA256 40b6763bf4afc5522faf57e0b444379866dbace2768dcc265314f6bf41406db8
MD5 9cf10ccc9d3726e12cf569b95b434d89
SHA1 8c3598912c95f48e686413fd042c3d422d45748e
SHA512 f3dd8cc98ea6b2df60727abfc507eaf2596d556da2af59e2da6f8423808ae307baf04db79f429ee83847731710f8dbb049d9dcb54a6d5ac94ffeedf15df15841
SSDEEP 12288:GaoVmp+84YX7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXc:GDVmpzT0fcT++foSBWU2YxhkgYiuWXc
TLSH
T12BB46B1139E48E72D0BF80354AE19A36A67BFC315E114FEB53906F4D3E31A819527B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3904	microsoftedgeupdatecore32.exe
2004	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5112	1080	WerFault.exe	76
2948	2004	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdatecore32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2004	eventviewer.exe
2004	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 3904	1080	2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	77
PID 1080 wrote to memory of 2004	1080	2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9cf10ccc9d3726e12cf569b95b434d89_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
  "microsoftedgeupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3904
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 1776
    3⤵
    - Program crash
    PID:2948
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1448
  2⤵
  - Program crash
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1080 -ip 1080
1⤵
PID:5008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2004 -ip 2004
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 215KB
SHA256 eecacdcc0750642ea8ff41a2c87bf81756e13fe6f0d4e67baccc41b9d494e190
MD5 82e2233d69f900e3d3438cd2e62d4cfc
SHA1 dc77421d722f58f2be20bf4716e62a6a1890873d
SHA512 2a4dd251684317e6d257c60097383f23e329ea5381ad63c2a7af9f1bdc4adf4c977bf07d51c669ca30d6ff7391e7bb96462777d87866f0aaa6f235630d025839
SSDEEP 3072:yb5oiaFrgqmpK92MZ/PXV+gX8eP6t7EmMHpZJXM:yYFrQpcnQiHHJXM
TLSH
T153244C68AC77F161BCA98E924DE9EA9A63E7BDF51611030F4E70BF502C03A97DB57001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a4b0b189a58d164f61a4464a5fae0522b554cb88cdee05e81a9dd7624188c3e6
MD5 5c4235c04064b492b529609be2a11c5d
SHA1 b3af6c71ed00016eaafa08c31b86ab9163024f68
SHA512 919647631e9bdab4978d9500cfc358ded5fce9e017b69d1d440afe8e4f5e6967d71d194dda3a5a5babe011c8973ff64f7308ba26567b7bf8ef48f8f9dd18c151
TLSH
T10DC08C080F9A0625E04403BE01608A021A109815E28BFF0E0BB12A580565F211812CAE
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 5988749ad48b196dca1187828587146497816fa638f312fa73379ae5b5664bb0
MD5 f0a88eb9f1cad838373b48bbaefbba1e
SHA1 23e8da913a2929e24d0d45413c0e8abd91643f4b
SHA512 c6e5774414f3f22671dc2e53601ca4642eb0c02da3bc8959b8373624d513b728d7113ea416d4705ac723281fe9ef1c268e60e2b7fda95cc963a42502b3e3783a
TLSH
T150D0222C5FE1023AF104C338E8B3C5262A42BA23A2A04F8902E189186C3BF217C10C00
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
Size 257KB
SHA256 eb0763b1876ae8b21b35dd8c132aecb94ac811983623ecd47902b8d938c85a3f
MD5 7daa5566b4fb35bf1561ba78a8e14b39
SHA1 fed2634cd5e3a7e725c888d7a3eb112f3946d95f
SHA512 7f3ec67b5e9e9a35e6efe715ef9810a71e5b64c39d8ad87f6d322960103b45c37a3b4c20a26d2fcc1072fad4dd7c4e0dfd3a5fd8dccf96cf1a58d361b2913a44
SSDEEP 6144:klPMoqFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++Cgq:w7IKucTm3RhMfoSBjA9U2Yxh+Zgq
TLSH
T1D044392138F84433D0B2D5B58BE4DA22A578F97256118DFB53D14B4E1E32A829277F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-19-0x00000000009E0000-0x0000000000ABF000-memory.dmp

Download

memory/2004-20-0x0000000000890000-0x000000000096F000-memory.dmp

Download

memory/3904-9-0x0000000000AE0000-0x0000000000BBF000-memory.dmp

Download