8511fbf67345f48fa70ba8a12cd4f27739bd59046cf47a3c22280e9cde1e4035

General

Target
2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260804-ffpj2sfr3w
SHA256 8511fbf67345f48fa70ba8a12cd4f27739bd59046cf47a3c22280e9cde1e4035
MD5 f91ef76950b8c222a0740123397257d0
SHA1 3ed39b8ddfbe31ea9211a3832799f9a4cd9cd32e
SHA512 096baa74bc46ad1085073baf10d61b08ccbcf7e5d87b7f8953deb2af22ce7cf020433f699add67742f4235eb3788a9c4c56f453c5876e1ba0c1a6a6b33a70961
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXo:GDVLa5S0vHyyLj8trn3wsliuWXo
TLSH
T103F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1268	jaureg32.exe
3180	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5096	4692	WerFault.exe	88
2736	3180	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	eventviewer.exe
3180	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1268	4692	2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	90
PID 4692 wrote to memory of 3180	4692	2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_f91ef76950b8c222a0740123397257d0_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1268
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 1592
    3⤵
    - Program crash
    PID:2736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1496
  2⤵
  - Program crash
  PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4692 -ip 4692
1⤵
PID:2344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3180 -ip 3180
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 121KB
SHA256 dcc69866c29527fa1cbde7c34081fa3d8e35e0746cabe40ed7f07e582392a74b
MD5 d647ce5103915fa34023e1f78668bca6
SHA1 9438b80117d1926241dbafa45874da7f4e9c5687
SHA512 90f2cc0fe38d576822ea36ae5ca3166d315069fdc60cc889bd08e7947c4d938a209a7e9f2dab7fbac33e6f4431480097802ad7d3b6a0b369b80c4484fd433ca1
SSDEEP 1536:zlGqAip6YSJRO8MIxOqa54yrO8/dDt+lFLpmHD8u5MXtleRwzyCAZYc/zgrWkyGM:9YyMjm1dQlFLw2d4RwzLkzgrCToJI
TLSH
T1CDC34EA89F37F960AD4B8F664DEED69612E512D52D01832F0E307E709F13A6BFA57040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 69b689eeef5f47e91480857dbc01af8b6e8497f24d5dd354d3062f9bbaa12877
MD5 96b50bd94df76fbe0d9db460431d4417
SHA1 829920ef3a791cf252af17cb6ea2cb603c9bcd25
SHA512 d2112ecb7002f54c35d9972a1f6eccacb3485f26eb60fcc92233ea24d6c4b6fb705e94f810f1b56db2856e7035f4b66755a54a9cb939abb78da28544c24625f1
TLSH
T1E5D0221A2BB2032AF022033A04B02696BFA2341BB9809F0C1F33050C8E6EE030C63C0C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 e3c8e265a185d69d0ee68dc25aeacd381ee17bf30f119d8c6f3330f8d45eba61
MD5 ecd8a1f9181964f0cb0766cebd2a365d
SHA1 a657fa188b43e4282e36511034484b41e3821d4f
SHA512 3dfaf46f09d0d11ab9ec21942c957d8722b7548485a03eb09a3c0703d98386e82b9d955135cd063a79304ae6188390371a1396c3a2dbef32dabe23896c260749
TLSH
T1F3C08C1C2AA25A06F2A8837C12C13903AB208501E6418F051BF12A88CA96B1A2878C6A
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads