f9081d4df2757b7edc6dd8f4a8a08d42b6706f28da292c4c50c0e3a95bb6b93b

General

Target
2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe
Size 212KB
Sample260719-2tt8caex9j
SHA256 f9081d4df2757b7edc6dd8f4a8a08d42b6706f28da292c4c50c0e3a95bb6b93b
MD5 4428b2729145e81462075c09f4e93208
SHA1 969615d65c90f7ad1525ab58a24ec71010eaa94c
SHA512 ee47bdb7cbb90512d4befab76bdbf8b2dc6cf4c07f4f72321b2e2cf7ff265f13cba9af8d6c46d498554939094275852c6ac00a02024e3f4615dc9751cc0dd3f9
SSDEEP 3072:0A2kZD7HMdVvGedfdtWPfjLAhajrWjKT9Onzel/BvFQa7C4erI/cj:0r83szpd16jXWjZMQaO8kj
TLSH
T16E24B213A6DC7CE2D039173137BB97E0CB2EED6045A1C95F62C402A5DA7C1937622BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 3 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1568	netsh.exe
3732	netsh.exe
2260	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2732	cmd.exe
5320	cmd.exe
2716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5432 wrote to memory of 5320	5432	2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe	89
PID 5432 wrote to memory of 2716	5432	2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe	91
PID 5432 wrote to memory of 2732	5432	2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe	93
PID 5320 wrote to memory of 1568	5320	cmd.exe	95
PID 2716 wrote to memory of 3732	2716	cmd.exe	96
PID 2732 wrote to memory of 2260	2732	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_4428b2729145e81462075c09f4e93208_amadey_cobalt-strike_elex_hellokitty_hijackloader_luca-s.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall delete rule name="ArmourySocketServer" dir=in
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ArmourySocketServer" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall delete rule name="ArmouryHtmlDebugServer" dir=in
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="ArmouryHtmlDebugServer" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall delete rule name="FrameworkService" dir=in
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="FrameworkService" dir=in
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2260