bf9a2148b995cfbde7a50577a8ef4748a96a73f9ad01d902cfe6c38157c0a840

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample261002-hefa4atale
SHA256 bf9a2148b995cfbde7a50577a8ef4748a96a73f9ad01d902cfe6c38157c0a840
MD5 a829a7961794203e3e6213864b8f435b
SHA1 074e2b73bc2c1df47481620b4ff8dc3748bfd386
SHA512 15674fbac9290c2acdb76f7e929f06d74e878fb31f71acd5a6c872b0f0a00c14899ebd3107636e1231c349727e248036967adcd645c7bb14f554b9ee5b8e8b7e
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWX/:GDVqlzYxGBcslpiuWX/
TLSH
T1BC947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
680	armsvc32.exe
3980	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2972	3980	WerFault.exe	87
4540	3756	WerFault.exe	85

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	eventviewer.exe
3980	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 680	3756	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	86
PID 3756 wrote to memory of 3980	3756	2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_a829a7961794203e3e6213864b8f435b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:680
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 1660
    3⤵
    - Program crash
    PID:2972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3756 -s 1212
  2⤵
  - Program crash
  PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3756 -ip 3756
1⤵
PID:3684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3980 -ip 3980
1⤵
PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D07CF1B9FF136D4730540DBA899C45D1
Size 178KB
SHA256 5b9ed3144ced01f75025b089c070af26c8b4f7633f5258db9f7b194f4ab48be4
MD5 d885b20a4fdad4146fa852242bc075e6
SHA1 2e1c8a234c423a0a45351b1109e996f6506a3052
SHA512 7fad8846ca2b193e1d28309006cb3b13cfa257d201c48c0a4b61fafd8b158007dd12c3f0f3b6ead715b3f4bf16f00b14284f23c2e61d01ea2829bcb5655f2bca
SSDEEP 3072:8M7XpFRHgbI9Yqxc0ITXB88brym4LpU91/VEFoZc:8MDHyUpxc0IzdXntVEMc
TLSH
T11B043B642DBBB5A05E4ACEE24CA98E9617FD61DE24127F1F4E346E105D03ABFCE17480
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 0fa456fe5aabe98144182d3bfc87ecad2378bba84163149c7b6cbbb3a049c4c7
MD5 dfbf7ee0555ecc8f59f6e8e188660c05
SHA1 686df39ebb4bef62fc3ffe4779157a18620b0866
SHA512 726460077368e63f22bf032dfe38327a7e8af5776f6b58ac92b446476980dc59bc68a89a5fe25aa7aefd40f5c4e6967505ba5c05215197a322db90235f1ee748
TLSH
T165C02B0C1A430700F188033C1180314187404100D880CF0505F206088197914B464C6A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 f189c391673917873d61eda9146f0a9900fe3b2a9c898c5aa5c604c79f86cbe9
MD5 3f3998d0061fcae94ee07e8023fb511e
SHA1 005971817cb9fb78db5f81405ba57c51682eff03
SHA512 1e26dce1da1b14629cc1625c0e2987f6f95b063ed319b80052b0b5e46bb44fa7cbbc3029a6d9a2488567ecce841d711af62a7bc2ed0507e09e8ed1baa26fd43b
TLSH
T158C08C1C1AA20A06F2A8437C12C139439B208101EA81CF052AF22A08C9D7B26A878C6A
MD5 SHA1 SHA512 TLSH

Submit Download

D07CF1B9FF136D4730540DBA899C45D1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
Size 246B
SHA256 55a447dc36ccb451b05b28ba8ee0325add51ae4973229a8ffd601c7ff9f6344c
MD5 9b7f28be0a1c756d47b943702c9b9344
SHA1 8f29ce5ac846f646f8c1dbb5684a3d0b800067bd
SHA512 585a6e1a8061a87f26cf3b75f5a077abfa0d385d6a166e82cb92a72bf6d89d24a43692afce21b349ab9dab3e379fc0a1e139f741fcc2d9f2b2d2358ac1322479
TLSH
T101D0225D2743033BF426873644A00B80C6B0AE14BC9147085BFE01288C2AF906820C0E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 1ae07f7ff9dd764863d073ac8de24a4aabdd1634ca07f33c7828d410e352d34f
MD5 14382387c65de5ae6bb96a2f8484fbfb
SHA1 5164d7688fb63367f791f8fc2b10eebc2ee02797
SHA512 a03a9c9da2577b4f422d7da3525566ebc83c352ece514f49162daab83d177bc25fd34004eccf82587d54688e799aa35dae63e53e6440f377189b90afc9b32657
TLSH
T11AC08C1C06618A17F2A883B912C229838A618110F3819F1126B22A08CD24F226834C29
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 e494efa9d6e09f326deca6022b79eaff849d832dd59a8f9fbfcbf42b5f00bca1
MD5 fdacd7db1e96d0efcd845a898fe14252
SHA1 1053c77e373a0e846ae83849495715f563e633bc
SHA512 912b849060acc2252e9bddc7834dec4ddd630b169f6ec9f15ae7b0f57c5521c864000dba5e4209d9ea3f0f0f4f7cef5dccf06d59ff6b23abe77f105ce1e19506
SSDEEP 1536:524HyOKCasJY2asmyLSRUUyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:51SOK96RXpWCmAZBtRb1BAwMW
TLSH
T1F524287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D66C827A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download