84f6d356544355d496ad199995620a2327d30e8201dcd2ff5617593177ed95f7

General

Target
2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260629-3t7dcaa17j
SHA256 84f6d356544355d496ad199995620a2327d30e8201dcd2ff5617593177ed95f7
MD5 1b3f2c6962d01a812020e6bb48c23723
SHA1 035266c4e6c1c4970ddf5430edb8309bd5cd9992
SHA512 6176c8d8adc5d7dbd5cc78ded4fb2cc2738dd526be0641d3b500d29966313e40dd0841aaaeb0a320dcb2e451114a068742d61ac6f2f5099be1c0b5a7ec2fbba4
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXN:GDVLa5S0vHyyLj8trn3wsliuWXN
TLSH
T1FBF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4288	jaureg32.exe
5992	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3696	5992	WerFault.exe	88
2412	2536	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5992	eventviewer.exe
5992	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 4288	2536	2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	87
PID 2536 wrote to memory of 5992	2536	2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_1b3f2c6962d01a812020e6bb48c23723_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4288
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 2088
    3⤵
    - Program crash
    PID:3696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 1768
  2⤵
  - Program crash
  PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 5992 -ip 5992
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2536 -ip 2536
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 61KB
SHA256 b558f742a93fa81bced86c59be3da643a4ac99c5121b3d158e1e3f0287ba2385
MD5 7252cf7362827ab48ece7f6133f88f91
SHA1 e32c13879dc1b14c1c2a278df6389cd9b4ad141c
SHA512 292b2fc63782eb6a0212655b578c6c473a1e65bcf30d224c5caf5ac6847b2b5f3844587522ac5eb6e640c6fa4316170088577b4f5f85380a4a3257dd5d43228a
SSDEEP 1536:Ao/dFPmAEiz3wacsMBQaa5oC8VNWsDSfLNX:P/xq3QamuWHX
TLSH
T178534E68EF77B264AD598E6A4EEAD69613E552D51E01030F0E307EB42F43AA7FF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 f9f4a9bcd5442c45e46acf47c0f3fbab08baf5fa75d6f05c7db238e249c12914
MD5 ec31b96ba1fe9ca67209c4ef521068a0
SHA1 579c63cd2b448bb0c4d8bb34f77f8070f9690b78
SHA512 a06efb2d6b6f839a3f6314b476c5a5de7910121f0017029ed88be60bea2ad54d9ae1dbfd7f8bd683ea97fb42672b340f5ca9230e9b688d286a6c073c2d028043
TLSH
T16DD0122D0F64132EF160D2BDD52049C269646357B9925B592BF1188DC43EE637CB090C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 41a9c98c112412411f0d2560f99174d571e73634d66a4d208330d215a61e13ba
MD5 0319beb61df1c171232af43010cd7ec9
SHA1 fafde00556de9a37101e7a71e85edb0dc3105914
SHA512 6edfe4911d6d2f3ebbcf45c81eb5687c84527203ee0381c7561c9bf94447ca041f2e026c4147486d9ac79e4fb31e84755526a08c8149454694940dbf0ae33e46
TLSH
T1A9C0801C1A510605F194437D01C13D0357109101F7458F051AF12504CD56B157834C2A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d1a108c7be86161c64768970e3f718b182cfd3f433ac54a648081ac753482c8a
MD5 3487cc462c1edb476ab9879d2d39efbf
SHA1 3cffc386b2f2531a18a09db4e190b9ccad5dca8f
SHA512 cb5372518c66a451a7d199259c5cf3256d01310d8bd7148cee93af00c59c623a99a8384cbc2396c24ded1c07dad67103fb70117c8a7084685b518b23e7416c14
TLSH
T1B7C08C1C1765060AF2A8C3B902C26D839A208110F7829F022AB12A08CD64F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads