7fce43439cd84320229a0b8b8fa3deacb29bab43d5012a73d0bb768a38d0b8bf

General

Target
2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260523-c8f7labw9l
SHA256 7fce43439cd84320229a0b8b8fa3deacb29bab43d5012a73d0bb768a38d0b8bf
MD5 9fd56f098f69a1f7a3cdc4e740327518
SHA1 b413188aeae273542cf2f0086e2fcac508d9c4ec
SHA512 b248b9e41ab8b82dc461352c77f0eeaed9a4c40394fe70939ec01ec9e93af1dbafb44ad7fa1bdc6492e214b2169bc28f4c9afe8ebd90a8bf43d3a69241d5b814
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXD:GDVLa5S0vHyyLj8trn3wsliuWXD
TLSH
T19FF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1524	jaureg32.exe
2368	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3972	1656	WerFault.exe	79
664	2368	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	eventviewer.exe
2368	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1524	1656	2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	80
PID 1656 wrote to memory of 2368	1656	2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_9fd56f098f69a1f7a3cdc4e740327518_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1524
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 1552
    3⤵
    - Program crash
    PID:664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1876
  2⤵
  - Program crash
  PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1656 -ip 1656
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2368 -ip 2368
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 222KB
SHA256 860b718c7ff22e13ab7ddc95eb025451cb28aa2e04a22caaecc18efe944c24a3
MD5 51c7635d94dacbea2ddc43c60c3179b5
SHA1 c06e259b0b8fa1a7f861a08df1e404bcd34f7e34
SHA512 caa28e1d0e3785bc588ed399b6510c73e2fe36c1004dce432eff210fba57f0b535c1491c6dd18a78dec1f57af53025abd095b73b111f1c1a5e7ef597ebca11d2
SSDEEP 3072:4ztZ8OqHpRG6e1QcLX4gGXaBmwv8THEtx+iIMIq/Qd:GZ8rpAFLsgtklMIe4
TLSH
T11F242B2C6C77F561BDA99E924DADEA9A23E77DF61621030F0E347E502C03A67CB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 cc54b8bd1d50c6ecac18fabe84c87430c819a5a613a84da9cbf63c9bb1e48a2d
MD5 7cbc7de0bbf35ca19b120829f50d7aaa
SHA1 1a1708bfe0481951303b69b55f8b5a1177daa5b1
SHA512 0424d39d9052aa80caa9aa26c6453c428728d8a67b59f9c703cf99663b6eb716617ee85e79a2649b537d6e89e6d7f6ecce2f5aab6cbfce649cb6a26aa5dcacb1
TLSH
T197C08C1C1AA60A16F6A8837C02C139139B608101F2818F0916F13A0DC992B1E6838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 6681eaef803a5ff3f27633cf750b50c5e688942bdcf9536cc4efae7ec8a935f1
MD5 260642d6606983f329323959eb364943
SHA1 3b8a002afa49912c39daee5cdff6013bbdc86576
SHA512 89a7dcb7353e42e9bd3f1643be85ba91a198b6afa2fbc0f6099bf8ce37b8f6d4ea275e8dea9f53414d2fdf0eebeababfe2762de37578924d34f806804b9ae071
TLSH
T158E0C2913BF80210E5B78B3D6A33A4489AB677276E11CACD1374408D6C24F99C936319
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 228d5bce535ab6f092e08fcd10894fc7fa6502d88bcecb99ed4caf55facbe64d
MD5 c126323bf7e5ce210d05fd4e67f93020
SHA1 5b67cbe7f9aedba1f8dc793fff24cb7fc6068954
SHA512 9a6d85d3cc9d6367077b6080838837214fc808778808fcbd3bcdac2695b93fd187d437add109bc98ca3169b8adaf66a549a55ea0bc7f5fc00fe66537e970e4b7
TLSH
T1E3D0126C1BB10275F4F8CA3E54714544FED25063B1A34B494276874D6C25F941D7294D
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads