Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
- Size 751KB
- Sample260523-c8f7labw9l
- SHA256 7fce43439cd84320229a0b8b8fa3deacb29bab43d5012a73d0bb768a38d0b8bf
- MD5 9fd56f098f69a1f7a3cdc4e740327518
- SHA1 b413188aeae273542cf2f0086e2fcac508d9c4ec
- SHA512 b248b9e41ab8b82dc461352c77f0eeaed9a4c40394fe70939ec01ec9e93af1dbafb44ad7fa1bdc6492e214b2169bc28f4c9afe8ebd90a8bf43d3a69241d5b814
- SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXD:GDVLa5S0vHyyLj8trn3wsliuWXD
- TLSH T19FF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 4960 jaureg32.exe 4844 eventviewer.exe - Loads dropped DLL 8 IoCs
pid Process 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvdllsurrogate64.exe eventviewer.exe File opened for modification C:\program files\7-zip\7z.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\pack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excel.exe eventviewer.exe File opened for modification C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\java.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\ktab.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\chrmstp.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\keytool.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\setup.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javac.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\graph.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\servertool.exe eventviewer.exe File created C:\program files\google\chrome\application\chrome_proxy.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\java.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\policytool.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\cnfnot32.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\os_update_handler.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\office16\ospprearm.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jhat.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jhat.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jabswitch.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File created C:\program files\common files\microsoft shared\office16\liclua.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\schemagen.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\kinit.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\140.0.7339.81\elevation_service.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\java.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdb.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jstat.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmic.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\klist.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javap.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jstatd.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\office16\liclua.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javaw.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jmap.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jrunscript.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\wsimport.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\xjc.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaw.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jsadebugd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\rmid.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File created C:\program files\common files\microsoft shared\clicktorun\inspectorofficegadget.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\tnameserv.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaureg32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe 4844 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2184 wrote to memory of 4960 2184 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 89 PID 2184 wrote to memory of 4844 2184 2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\jaureg32.exe"jaureg32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4960
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
- Size 514KB
- SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
- MD5 806e21e089327eff35ab9d91c7a7b963
- SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
- SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
- SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
- TLSH T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 295d42622eaa9a87aa3825f696c9b6bc29d1eb8e17d3ec657e48388c61dacc4e
- MD5 25b303fa513b5f83e0139c9035050912
- SHA1 eebcbdb9f68bebb2c75093129bbb188e189a8917
- SHA512 509ef53730ff4aa426ec53342312104a951b2bf0fd7657d7b6afc556aceb1b01e1ea668c6499a783262ae6a3351bf7ad45f8ba7cd8cefbd5b5404b6775739666
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQB:GjuDOhVLPfnOsUXIYds
- TLSH T14FE3AE1136D08477E1BA16314C37AB65C776FCB59A72860BA760BFDD3C349808D2A7A3
- MD5 SHA1 SHA512 SSDEEP TLSH