84cb6ecea9f096e1d6e2bf785636bdd61c1bb319f2f0c52733950559af420112

General

Target
2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260528-caeacac18p
SHA256 84cb6ecea9f096e1d6e2bf785636bdd61c1bb319f2f0c52733950559af420112
MD5 01a5032ce55e17110bda009c3d6d6dcf
SHA1 f61181a182fbe4401bdac92a17d56faf5f4324bf
SHA512 c3a08cb8b27d80d4cd7d3aed44e58ea6830e1cdd15784423b6e61825947feb001cdb32b92e174c1e88617f254cbfe0670f81170a0ff18c79554243216f1079a2
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXa:GDVLa5S0vHyyLj8trn3wsliuWXa
TLSH
T130F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4020	jaureg32.exe
3000	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1608	3480	WerFault.exe	80
1304	3000	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	eventviewer.exe
3000	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4020	3480	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	81
PID 3480 wrote to memory of 3000	3480	2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_01a5032ce55e17110bda009c3d6d6dcf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4020
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 1548
    3⤵
    - Program crash
    PID:1304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 1704
  2⤵
  - Program crash
  PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3480 -ip 3480
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3000 -ip 3000
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 219KB
SHA256 8eafbc8d0e91ae1d960fbf45d4283a50ca34505d778f0b980f82a6e4930e4e2a
MD5 77896b0b19ebce322ad227b611bf3545
SHA1 fd9c31a66ee836b035e1dd118e012eb3185fa497
SHA512 1159315c0ae0194817733395c3107c9f7faa8529694c8a07cb0fac1ade75069366f6fccb89279b12fc84ac92b9bfa2ecc6ffad2c5c7b064f13d57d7fbb806331
SSDEEP 3072:ylOqHpRG6D1xv1XsfQXFJeb27hEgtQk9IMBBKDNF:ylrpf91rJtH+MBIv
TLSH
T1DA24182C6C77F561BDA98E524DEDEA9663E7BDF61621030F0E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 36beb3090178846ef54e1cba931d3783334b3a41159ee0c3f73b72c2572c6725
MD5 073a55e8ef86cd6d6ce2b0055d91cbb4
SHA1 0137343f919c6592ecee2de57bb2c8887d2a3b02
SHA512 d9b262058962070c0edcf16abf336d85a8aafc790ffd32961fa4f45841f56bda9ee499ffaebcdffdc5c0b93a2d140f807c420af51ac23b59084ae9dfeccee854
TLSH
T1BDC08C1C2EA61A0AF2AC437C02C139039B208101F2818F0626F12A08CA92F166838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 d0ac5d2fa2663cb396274762977d0391e75d6834a88001dbd73272d707e3c193
MD5 d62807c5d5473be20aebd4e5649571f0
SHA1 00ea584a17bb1433043d967eb50c523f070d0a4d
SHA512 76ef42afa1ca152148579405a2e14d568533aa36d4aec745ece74386f14099eef44989b2a828ae213ea1d910ad7b584acc797d676ccf63f4e5ce290e7d057245
TLSH
T133D0222C0FD1893DF074C53688734D91DAA16A32B671CB8A20F2086C7827F002EA380C
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads