31b46469fcbe95703efb99e333f992fdf1f745eb67c4afc4023d81384ef2ed54

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260820-sdtr7sea85
SHA256 31b46469fcbe95703efb99e333f992fdf1f745eb67c4afc4023d81384ef2ed54
MD5 96b224fc526d564713a765c7845ea87c
SHA1 4fe758a8b8422de9e9743967e6bf36d9d7800d32
SHA512 c58330d236ebc232dd91e3e1bab7d212ed61b7a436d49694c4f79916adad3623b3975858ad94f66dc65131c3b561b8461f183f910087e64b96210637c7ba44bf
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXa:GDVLa5S0vHyyLj8trn3wsliuWXa
TLSH
T1BDF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3864	jaureg32.exe
2992	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4896	1376	WerFault.exe	84
116	2992	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	eventviewer.exe
2992	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 3864	1376	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	85
PID 1376 wrote to memory of 2992	1376	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3864
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2992
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 1892
    3⤵
    - Program crash
    PID:116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 1304
  2⤵
  - Program crash
  PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1376 -ip 1376
1⤵
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2992 -ip 2992
1⤵
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 162KB
SHA256 8374ebb47f1f308a451572b1076383cc03a42fdebe325bb5025efba210b09c04
MD5 dbb62f3285b1704e5dbb593a8d915040
SHA1 3b72cee2d959c203c2f5afd129bf52fc3055c6bf
SHA512 f1bf113bb43742ce98a37d63da5e509a3b196a4e23ea942c22a3371899363f7add3c66a3a93fb07c76486b1fa0e0788da466f33119c600cbd5938e2686ac6767
SSDEEP 3072:/WLFrPddWb2qTGEaQdPDHd3ygIY0dTwJ53P2:uLwbRTSQhDHdCl63O
TLSH
T1FAF31BA8AF3BBAA06D47CF564DDEC65612E592D52911832F0E347E705F13AAFFA53000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 7b2882d12ca89f4bbec2679e72d6243e76440957ccedcb83613e532ce82641aa
MD5 07748ac55c052044f62b124dffdfd751
SHA1 f19114c5cab1d07abcf43bd55fd8f2b4f6da806f
SHA512 10009d5e652d8c701b044b5ae7ab2d06330d1161891a4137df8d4e5878edc22ca7b34746c722b42b5478ffb3eaf9f5da0474ad230edbdb108303c4b264b421d9
TLSH
T15ED022001B660359F001827B855009C6DA966017B1C09B8A0FA3030D9C2C74A95B082C
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 5643e4fcfd3dbb582820b1e502198ef117ee54a56a315d607a0db07ecd4ee928
MD5 77d0bde0650c999226e68601ca7efe0d
SHA1 1a198b1949241e4498d59e513b537483e91a7c1d
SHA512 b649c6f119b1045a351770879adcc9f48f555f1dd6965050c90bf9dd7889f8951a9a6d040967e23f7a09e9989084fe556b58504a83cd757511c986da56bc4796
TLSH
T179C0801C19510505F195437C01C13903DB214101E2418F0516F12544C956B156934C29
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 6400e044927836224c467b6d25f1db8129467fed741945f923f82e1a0569e566
MD5 70a261553df31a68c2074c55f89ceec1
SHA1 eab92168e6e7f4671153b8c1274a3b83cfa5b479
SHA512 7ce9242e5bf3eb6605332058d0c4a3ae18341f2e327bbe27adf99edef87164e16ea3bf74d17ea0e318cda59bc3022292293fe914b4f687f277108b948bd5f3f2
TLSH
T1E4C02B0C03010314F2C8437802411181CB404100F4D05B0102B5160C8936F006430C55
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 174KB
SHA256 fe066f27584add388c76f9f8a415a49ba8a2ab1f041bd515af24473794941a62
MD5 5f56dfedef0aebceee68f39cbc2ea38e
SHA1 d5838ec32abf5ecfde06de9cdfbbfb5a1dc58906
SHA512 97e47b2fd2982447d10b46d5b1e9bd5a533b4577d8911ce29f211986f1b917c90f256d437f9bccb229b17ec500c6d121d7079ef6a0f01e24db61b0cfd4670810
SSDEEP 1536:LJAyOPkasJBN8EBLFOQpbHtphwSHPPnOED4LZFasjG6P1fkN9WlQIW:hOPKXpxvMZS6PRkIW
TLSH
T12004C63223F008B784D706D46E396D2D6DE8DE47E11288D8F75E4BA12F868B5DE335A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download