bae722d7a77480ea7c171c6ce83fb8e6a02b4190b55261c394b11c9ae84e844c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Size 494KB
Sample261024-jg4bdagw41
SHA256 bae722d7a77480ea7c171c6ce83fb8e6a02b4190b55261c394b11c9ae84e844c
MD5 7b811904d3108929c2cc6cd7c1f0cc11
SHA1 e80a5e9ce54bccaca521ef831c58b9768f6a136b
SHA512 f67931deee884d3322c630fbf93d13b2ea4dd645e965d6ea70e1add06cb1fc2904487a8d62f34f8941d4076f036e513ff843660dcfdd43654b30c6a3e88b3ccd
SSDEEP 12288:GaoVmp+84YX7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXj:GDVmpzT0fcT++foSBWU2YxhkgYiuWXj
TLSH
T162B46B1139E48E72D0BF80354AE19A36A67BFC315E114FEB53906F4D3E31A819527B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4100	microsoftedgeupdatecore32.exe
1132	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2524	1132	WerFault.exe	90
3392	2564	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdatecore32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1132	eventviewer.exe
1132	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 4100	2564	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	89
PID 2564 wrote to memory of 1132	2564	2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_7b811904d3108929c2cc6cd7c1f0cc11_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
  "microsoftedgeupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 1588
    3⤵
    - Program crash
    PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2564 -s 1500
  2⤵
  - Program crash
  PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1132 -ip 1132
1⤵
PID:4644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2564 -ip 2564
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 185KB
SHA256 5fb577708cef250f8367994d29c1c0ced15e5fa1ba2eca485126d315618e7b30
MD5 4fcc99424e3f388607667a017604bd12
SHA1 09012b4fd195175279373028d197fc9a218efda3
SHA512 98b7aa175e3890fd0cd895763fc3a9bd1e52d92da6b532576dbce3364cb595918e1e9edc3e0e1d2657fae3d97d5c8cc65b2c5e06d0f7456e433f8fdc8c0af040
SSDEEP 3072:p6hnm7XAZfwGwQRx+Nby4dtnq4JgziaCAMlGBGvuv:QiRaH4d1q4Cz1x0GEGv
TLSH
T114041D282DBBB1619E0ACDE14C9AAE5613FD71DF21123F1B4EB56ED01D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 25f7981063f118257d15a6f306b84d53df0ad67a3e7e2eaf5cff0dcccd6e9f58
MD5 ccecd10c3bbbfbdc14b52832a688b6e8
SHA1 f5959c04e665606081810ad871dc7b655f744807
SHA512 6215a06ec40da63cbd9d3b6666f51c9b6514bac52d36583e09e8fcda69149a465dd06a3ad280c81118a27a79e78fb1dba1a22cfb11bcaef7384f1bef86cd3249
TLSH
T170C022082A828300F288033E02803202CB808200E0C08F0A0AF20A08E22BA0A38A8CAB
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 75b8434bffc644bfc66390bdcfaceafa7bf9fe793cff1687ebc5e6a4ac8f5b7d
MD5 fa56cf636d79e4517e3a4cb605cff2d8
SHA1 b0a7e8b16cf7c9de990592ed435331341f1b4ff4
SHA512 c9460400bcae05f6634b3a1d98c76b9fd4900b80bd96925f44c2174289068759c9e63bf6c743a852a83239a62423a9a3f53760e8da506ca92ed96f0087d3da35
TLSH
T1D6C08C1C1AA24A06F2A8437D02C139039B208101F3C18F051AF12A08EA9AB162CB8C6A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 c5288db85698d284aa77c114fc52b87f1a9da634023ffd136e9fc6834c5fb4a6
MD5 7f27d76d2399a5f4dadc2465dc96cb61
SHA1 fab3530578cc7753d0145e427dc04c16d319ae93
SHA512 39eaad86eef3a4dec2e75e3229bedf42bec125e16bc7cbca09561489e5be0d13d91cfdd1d596c023f001a503a52223c744844bcd3b1f1871ca879c73b2d21188
TLSH
T195D022102F600637F0212379C6A001026BE09C09FAA247491B201A5C8C29EC10C52E0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 12c90da1cfaa2856b6a5cb051c5ce00963198505bad203e7e8f8bf380c12576c
MD5 395b56218ced0bc68f7e76d43b7419be
SHA1 d4079ec093b3154390461532cd3edda3b52a0751
SHA512 d1a4ec772d709cc117ac6d98043770656e809687787a6810cda1355b7d1df6fe00c949fa099855bb07598bad68668e6c6d372d811b130820e97d4e397a2c8b1c
TLSH
T1B6C0920C57565315F68C97B912926282CB909610F691AB161AF60A5CDA3AF0528B0DAA
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
Size 257KB
SHA256 eb0763b1876ae8b21b35dd8c132aecb94ac811983623ecd47902b8d938c85a3f
MD5 7daa5566b4fb35bf1561ba78a8e14b39
SHA1 fed2634cd5e3a7e725c888d7a3eb112f3946d95f
SHA512 7f3ec67b5e9e9a35e6efe715ef9810a71e5b64c39d8ad87f6d322960103b45c37a3b4c20a26d2fcc1072fad4dd7c4e0dfd3a5fd8dccf96cf1a58d361b2913a44
SSDEEP 6144:klPMoqFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++Cgq:w7IKucTm3RhMfoSBjA9U2Yxh+Zgq
TLSH
T1D044392138F84433D0B2D5B58BE4DA22A578F97256118DFB53D14B4E1E32A829277F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 a5515f75e61d5b16dc1dbdb9d53c34996b6c1e8dc483901bd020063caecd073c
MD5 e84038e04b59ae23777b1c3dc6e668b6
SHA1 d22cb107ea3997c1bc0c17e7b471ef4202594f34
SHA512 cddb0262f23050624b0f0e418a68acb82e122173d91bb920b895b81cb9544bc865d735352974d0a2ab3e86a3e9836a5871dd980f9c4c9ec428924a7275671c0b
SSDEEP 192:b4QmVi+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:b4QmViz24xhbyO+OmtzIYu6MklJ
TLSH
T19F42D57B5822842226F1515F7BBFB208E026F2079541DCD1BE8C43051F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 e7e41c604883f75c70d512c2752a2c1c164a256786b13dc90dcc68252ea37ac8
MD5 5960273830d026c9f55c2ecc921105db
SHA1 1adbc002f2ea81a31dc609a1cbcf6a8aba7e5067
SHA512 bd818a47aab7ded12d0415f4db4c7fd861590ece6c4fcf9c17dddd6d2a1c1253501817e91aa11eba424d6c52531fa0372504af82e9a0401898e839aa999e2516
SSDEEP 1536:J24HyOTCasJY2asmyvmRUhyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:J1SOTp6MXpWCmAZBtRb1BAwMW
TLSH
T13524287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download