1d4669c5ffce14745cd4cd9ffd62247765cce8d02390a79026d9ceadaa8924ca

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Size 494KB
Sample260820-ask5hacl7x
SHA256 1d4669c5ffce14745cd4cd9ffd62247765cce8d02390a79026d9ceadaa8924ca
MD5 3c0568e9ede7b78b50250612ed859489
SHA1 949d594bd8b5c5b5762d6e5b4c34a218606e689f
SHA512 4e3dda8ff5ad5df7aa22388629f9bae428fb5ad4933985b9878cda298b88868ccea9f03b9ad28d3ddfeb440c581c6ae2a6def8988f38619f1a4427213b8d6ed8
SSDEEP 12288:GaoVmp+84YX7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXq:GDVmpzT0fcT++foSBWU2YxhkgYiuWXq
TLSH
T1DCB46B1139E48E72D0BF80354AE19A36A67BFC315E114FEB53906F4D3E31A819527B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2188	microsoftedgeupdatecore32.exe
5920	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5728	5920	WerFault.exe	89
3948	4488	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdatecore32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5920	eventviewer.exe
5920	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2188	4488	2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	88
PID 4488 wrote to memory of 5920	4488	2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_3c0568e9ede7b78b50250612ed859489_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
  "microsoftedgeupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2188
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5920 -s 1608
    3⤵
    - Program crash
    PID:5728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 1396
  2⤵
  - Program crash
  PID:3948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5920 -ip 5920
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4488 -ip 4488
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsoftedgeupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
Size 257KB
SHA256 eb0763b1876ae8b21b35dd8c132aecb94ac811983623ecd47902b8d938c85a3f
MD5 7daa5566b4fb35bf1561ba78a8e14b39
SHA1 fed2634cd5e3a7e725c888d7a3eb112f3946d95f
SHA512 7f3ec67b5e9e9a35e6efe715ef9810a71e5b64c39d8ad87f6d322960103b45c37a3b4c20a26d2fcc1072fad4dd7c4e0dfd3a5fd8dccf96cf1a58d361b2913a44
SSDEEP 6144:klPMoqFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++Cgq:w7IKucTm3RhMfoSBjA9U2Yxh+Zgq
TLSH
T1D044392138F84433D0B2D5B58BE4DA22A578F97256118DFB53D14B4E1E32A829277F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 174KB
SHA256 7d7a9e151d74c83e61f3acda10504ca1ce6c2224b15047d1ab863b1ad603f578
MD5 2d3e52ff02d2780cd665fa15d84007d2
SHA1 5576abe1341c237611f67940f10cba27a52a49e3
SHA512 da648ca1dd627af254f2ed372c4599d1c57df70a40cbf44a761eac362b0442bf3792a47e63746deae256d6cdb4dfdca7851f481e6bff67acc520e283cfcb7a3b
SSDEEP 1536:fJAyOPkasJBN8EBLFOQpbHtphwSHPPnOED4LZFasjG6P1TkN9WlQIW:NOPKXpxvMZS6PhkIW
TLSH
T12E04C63223F008B784D706D46E396D2D6DE8DE47E11288D8F75E4BA12F868B5DE335A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download