31b46469fcbe95703efb99e333f992fdf1f745eb67c4afc4023d81384ef2ed54

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample260820-sdtr7sea85
SHA256 31b46469fcbe95703efb99e333f992fdf1f745eb67c4afc4023d81384ef2ed54
MD5 96b224fc526d564713a765c7845ea87c
SHA1 4fe758a8b8422de9e9743967e6bf36d9d7800d32
SHA512 c58330d236ebc232dd91e3e1bab7d212ed61b7a436d49694c4f79916adad3623b3975858ad94f66dc65131c3b561b8461f183f910087e64b96210637c7ba44bf
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXa:GDVLa5S0vHyyLj8trn3wsliuWXa
TLSH
T1BDF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3400	jaureg32.exe
3352	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe
3352	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3400	1672	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	89
PID 1672 wrote to memory of 3352	1672	2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 162KB
SHA256 8374ebb47f1f308a451572b1076383cc03a42fdebe325bb5025efba210b09c04
MD5 dbb62f3285b1704e5dbb593a8d915040
SHA1 3b72cee2d959c203c2f5afd129bf52fc3055c6bf
SHA512 f1bf113bb43742ce98a37d63da5e509a3b196a4e23ea942c22a3371899363f7add3c66a3a93fb07c76486b1fa0e0788da466f33119c600cbd5938e2686ac6767
SSDEEP 3072:/WLFrPddWb2qTGEaQdPDHd3ygIY0dTwJ53P2:uLwbRTSQhDHdCl63O
TLSH
T1FAF31BA8AF3BBAA06D47CF564DDEC65612E592D52911832F0E347E705F13AAFFA53000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 407aab738d4e118cdd32bb12a6f5ed0f408fba3bf039fe8dab0f9b5d8932a585
MD5 817bc756e37542b74fbde4b4776aa51f
SHA1 74a3483989706a6b31ad3810ac67565d10e7cc34
SHA512 0574a676ae697242e86494cd3dbba2082f37b23e183b4cca66b231926430ada8f22523afa0cb71cd4c92d68943d6da6aedbb8367b92cfdb237be81c0207a0af4
TLSH
T1F2D08C042BA6032AF126827B48A202C6EEDB1042B0D08BC909F3024C8C2EB0A9A21C2D
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 aa584cb54b751387b73992253dafb7e69074c957b2a84381f04c29fdf81c9722
MD5 50406e9fe199d779f7d705828ae02840
SHA1 fe973ca1fc36286fd811588ae1b535de889b4a14
SHA512 d2e58ac015d4bf5e50a59ce335dc407057c20cace823cac4eecbdb35ee3719c99700d9ba693b10e800e272354e89cb2d27bd8a270d23171493c812bbd2d7f019
TLSH
T1F7C08C2C1AA20A0AF2A8437C02C17943AB218101E2818F051BF26A08C99AB1A6C38C2A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b4b3941be957c0a4e3d9b473a2df75ea976a0e5783628fa04ddbb2724998522a
MD5 b0cd47ef565f7e32f5bc8e5f48fbdd69
SHA1 e4d59b53abc44d60cd19c6d109647b13e9fc7236
SHA512 d20916a6fb0aaaefe95b2b188f9f3d78b816219123171fb756801c7d9d411f326dbbf364ce3e54925142e6ef9fcb1c08675d349b79edef0c6a2adf6862bf45a1
TLSH
T131C08C1C06620607F2A883B802C269838B208110F3C2AF0126B12A0CDD24F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-20_96b224fc526d564713a765c7845ea87c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
SHA256 31b46469fcbe95703efb99e333f992fdf1f745eb67c4afc4023d81384ef2ed54
MD5 96b224fc526d564713a765c7845ea87c
SHA1 4fe758a8b8422de9e9743967e6bf36d9d7800d32
SHA512 c58330d236ebc232dd91e3e1bab7d212ed61b7a436d49694c4f79916adad3623b3975858ad94f66dc65131c3b561b8461f183f910087e64b96210637c7ba44bf
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXa:GDVLa5S0vHyyLj8trn3wsliuWXa
TLSH
T1BDF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX2573.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX2573.tmp
Size 152KB
SHA256 53d17a488db88d5878a1e47f2896718cb1eccd11da5e449a51976514c3bcf1b8
MD5 1432bc856edc225f3f837230225d47ff
SHA1 fd0109512d4063687acc7c526301e4421d47d702
SHA512 61a1b0c8bf7c4f311a0ddcc2d9a4fbcea507fc90d7edf2b8351a7f2348ee37e7e3114e58436ceae4a8d517383f32b49dac7a3c507513778b8020e3925a55e8d4
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMGfnOssP5XIY2MpQp:ujuDOhVLAFfnOsUXIYnU
TLSH
T17EE3AF1136D08473E1BA16314D37ABA5C77AFCB65A72860B9760BF9D3C345808D2A7B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 236KB
SHA256 fd456885ebabc3bd7f3ddecd7d9369373a273843bf9d75c85ff3e6717484399a
MD5 c5897994387f7d2fd8a81a688ecf25cb
SHA1 e449c7e3720db06a35be7f077fc7d6ef3f5a2d85
SHA512 8b3a3bc97c01d8bae6a59a3da8e5548da2147ad011104805a9e82a092944984018039b40f7d2f9483d30b731c92a64b803ce2d67e378c278beaf346af4e67aea
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQbiYV0OZNjrc1F+QUQoRlMe:GjuDOhVLPfnOsUXIYdiiuW1FXEJ
TLSH
T1C834AE1136D08472E1B905314C76AB79C77AFCB45B318687A764FF9D3C34A808E2A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 295d42622eaa9a87aa3825f696c9b6bc29d1eb8e17d3ec657e48388c61dacc4e
MD5 25b303fa513b5f83e0139c9035050912
SHA1 eebcbdb9f68bebb2c75093129bbb188e189a8917
SHA512 509ef53730ff4aa426ec53342312104a951b2bf0fd7657d7b6afc556aceb1b01e1ea668c6499a783262ae6a3351bf7ad45f8ba7cd8cefbd5b5404b6775739666
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6GfnOssP5XIY8MpQB:GjuDOhVLPfnOsUXIYds
TLSH
T14FE3AE1136D08477E1BA16314C37AB65C776FCB59A72860BA760BFDD3C349808D2A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download