84cb6ecea9f096e1d6e2bf785636bdd61c1bb319f2f0c52733950559af420112

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260528-caeacac18p
SHA256 84cb6ecea9f096e1d6e2bf785636bdd61c1bb319f2f0c52733950559af420112
MD5 01a5032ce55e17110bda009c3d6d6dcf
SHA1 f61181a182fbe4401bdac92a17d56faf5f4324bf
SHA512 c3a08cb8b27d80d4cd7d3aed44e58ea6830e1cdd15784423b6e61825947feb001cdb32b92e174c1e88617f254cbfe0670f81170a0ff18c79554243216f1079a2
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXa:GDVLa5S0vHyyLj8trn3wsliuWXa
TLSH
T130F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4164	jaureg32.exe
1572	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1792	1128	WerFault.exe	85
2488	1572	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1572	eventviewer.exe
1572	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4164	1128	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	86
PID 1128 wrote to memory of 1572	1128	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4164
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1328
    3⤵
    - Program crash
    PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1128 -s 1916
  2⤵
  - Program crash
  PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1128 -ip 1128
1⤵
PID:1720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1572 -ip 1572
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 107KB
SHA256 fb1dc6bf1654b28dc6c9b9b6ca4b8eb989bfab98391430b43179b15d370d524f
MD5 b051d4ad3bc6a7eb9b1b19c735deaf06
SHA1 26f44a06a4cc3ec1233c098d6cc9b7161ef0fff2
SHA512 dff7eaba5c210136440d97ba297305b847b440ec4363239bddfc70ca1afadec8d47d3a23bbbfdb11b054838859958919615fc4f779b103b9f5fa68b0f991a541
SSDEEP 1536:zJAyOaasJD06LFOQpbHtphwSHPPnOED4LZFasOtN9WlQIz:pOUXpxvMZ+tIz
TLSH
T140B32B7163F00ABA60C343A47B6476697E55D18BE113C1ECB3BE52516F83DB28C37A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download