Overview

overview

7

Static

static

3

2026-05-11...uc.exe

windows10-2004-x64

7

2026-05-11...uc.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/05/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-11_a412cec1dc20f4b99d057f55f260a9ff_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
  • Size 596KB
  • Sample260511-dft4esdy6m
  • SHA256 8d98d44efbee6ff1550abc972fdbc375c914593946e2192be853cd843b70f314
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-11_a412cec1dc20f4b99d057f55f260a9ff_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-11_a412cec1dc20f4b99d057f55f260a9ff_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Local\Temp\adobearmhelper32.exe
      "adobearmhelper32.exe "
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
          4⤵
            PID:6048
      • C:\Windows\SysWOW64\eventviewer.exe
        "C:\Windows\system32\eventviewer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4880
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 2136
          3⤵
          • Program crash
          PID:676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4880 -ip 4880
      1⤵
        PID:4424

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            ArmReport.ini
            • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
            • Size 782B
            • SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            RdrManifest2.msi
            • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
            • Size 18KB
            • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Size 4KB
            • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
            • Size 342B
            • SHA256 4d112698a5627c6c5fa2e31074847bf94dcc62e2dddfe196bab2314de7b8e223
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmUI.ini
            • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
            • Size 251KB
            • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TmpBB6B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\TmpBB6B.tmp
            • Size 3KB
            • SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TmpD58D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\TmpD58D.tmp
            • Size 3KB
            • SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            TmpD5AD.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\TmpD5AD.tmp
            • Size 3KB
            • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            adobearmhelper32.exe
            • Path C:\Users\Admin\AppData\Local\Temp\adobearmhelper32.exe
            • Size 359KB
            • SHA256 9977725432104dd5286ccfd06b485c8fdf7cbd63143ea62ea5e218e5768c6703
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tmp7F5.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\tmp7F5.tmp
            • Size 148KB
            • SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            eventviewer.exe
            • Path C:\Windows\SysWOW64\eventviewer.exe
            • Size 88KB
            • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4840-95-0x0000000000E80000-0x0000000000F2F000-memory.dmp
            Download

            memory/4840-290-0x0000000000E80000-0x0000000000F2F000-memory.dmp
            Download