dbbcf49caf718087355be57e9584543a745af0b9137e2a551b8a73d65dc9ea43

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample261026-rafwhabc38
SHA256 dbbcf49caf718087355be57e9584543a745af0b9137e2a551b8a73d65dc9ea43
MD5 bdeb4daf0055beae4eb8434508857c23
SHA1 c7f1b7f3a1f6941491bb70c3d18aa32bef642d8c
SHA512 e15a3e0d18fca8cc70fd835d98bea0dbc52c733ed52a4d228ea274d26f28f32bfcad76b96338771f4e3bc41581a363ddcd22ccdbb45ce0bedf120a3ccbb63213
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXP:GDVLa5S0vHyyLj8trn3wsliuWXP
TLSH
T141F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1612	jaureg32.exe
2636	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4288	4872	WerFault.exe	88
3752	2636	WerFault.exe	91

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2636	eventviewer.exe
2636	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 1612	4872	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	89
PID 4872 wrote to memory of 2636	4872	2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_bdeb4daf0055beae4eb8434508857c23_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1612
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 1608
    3⤵
    - Program crash
    PID:3752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 1968
  2⤵
  - Program crash
  PID:4288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4872 -ip 4872
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2636 -ip 2636
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 190KB
SHA256 825f27845e63f7f5a1557f7f4901c315bc9814fb6fbca037e3939168a6584123
MD5 4e41590e70035949186929b45088d50f
SHA1 f90f794e22a14522ccc22560eaaa78fbf041501e
SHA512 37e6597057a2dd9fd6571a5d7db5b7aa857d354b09dffea0c094c653c67300983cd09a6094a7cf72e3db7a949e4117951784aba6f80ff949856e49708e8c53a9
SSDEEP 3072:VhnmUfAZMwGwQWxDrcy0BAhDhJiZQl0+tMlom+CB:VpGxv0BiDhkZ1a0o3U
TLSH
T1B7140C286DBBB1619E0ACDE14CDAAE5652FD719F21023F1B4EF46ED01D43ABB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 1c7e61e56e345ace73608ce89e89b78f55941126bb12197321666f471dbb2967
MD5 0d3fda105bf56c02d1681fe1e57a6397
SHA1 af65f6a3d5337dac09777b8c181536e3da7e3d93
SHA512 b6560a67db7cc192a2e1b7170aa9092981384b98432c52399248aae6942e8ad1e37d7f9451910d9246d402b8dd34186eb2276b1b60b6007415bbe37f05ca8fdd
TLSH
T1B4C02B082A420240F188033D0380710187404200D0808F060AF106088717904B924C6A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 32af70529acf2ba5611969a5598a2cec6de39bf489bd0c70f5301d21a254d106
MD5 2538d8311bf74ef72cae6403b20629df
SHA1 f267397902089958c9e7130d4729200b5f738e8b
SHA512 45ad6ebeb0eca3c53e2ca89862b59a02749b8f330acbe92b63d99e94bc1cd6731fd7de12c8866f63a0e4184707c2416ad2bd19dc2d2cbbc6fdc83062119d52e3
TLSH
T12CC08C1C2AA60A46F2A8437D03C179039B208201E2818F062BF12A08CE96B16AD38C6A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 0f252c943473182a1a4ad31cf819bb8bb50284045604abf745ec6fb3468e2462
MD5 5fcc1e451bf6088a744af02ccdbea9a6
SHA1 9e2f274782ce311d628fc840b2435aa683bed961
SHA512 5c2f8c6b2042f8f30e03091d58b1e9fa459baa82727cde07f926452ad45a748e9a6e87a00ff2c05e87ed84aa072264070c69110d9ed680e5a92e8762bb7e49b9
TLSH
T170D022001FE20272FD8C0B3DD8F10A82C7A03201FF82A70A1FA2AA9C982E6030410C1D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 18dcf6f23506c28098cb2dfe4a23927aa6875eee54c8995accf299985e3df7de
MD5 95e814a4b3a98f1c21566403ca13d98e
SHA1 0225ff8c330d4365543a21f48e98f82e59806bfd
SHA512 dbd75aa22f644219eaa569495eca5698eb64febc3d85660f06f87ea19210f3b7c6736eea5d98467709c125bd5aa97a6943c834fdd0ac810fce60f229d17e00d7
TLSH
T109C08C1C06610606F2A893B902C229838A208210F3819F022BB23A08CE24F122C74C2A
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 5ae022471ff30deaaab2a5a49aaaeeaef5b6db493b54e170a15028aaa22d8ac2
MD5 94df3c6faeff449a49e19978321edae3
SHA1 e5f60b80ce81a7d9dfacd9b9e8eac868ae867669
SHA512 3ff6b9c7ea6166fa8f9054529e0cc2c441db285b16a26004ef55cf37da6f42537d73b594f5340a94d6997f0174b8070b83ddc2818ec86aaf8860bf4287b8f2be
SSDEEP 192:A4QmVi+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:A4QmViz24xhbyO+OmtzIYu6MklJ
TLSH
T18742D67B5825842225F1515F7BBFB208E026F2079541DCD1BE8C43052F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 e9a65e75500d1c773772b328ccbd85bb844fe3729b80d9453b34ff1c8c601eb5
MD5 51e9d090b8560b4fdcae2848e54cd842
SHA1 80d72bb08e85a5521b5b070ea53b755a4f35dd3d
SHA512 70f1a6433b2c76a300bb24e833cc9a863a577830ba838cda8a4fd70d2be5a10449dbf1e2e440018ec5c311ced903ed688658ddb226e9ad6d0babe031add657b2
SSDEEP 1536:K24HyOTCasJY2asmyvmRUhyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:K1SOTV6MXpWCmAZBtRb1BAwMW
TLSH
T15F24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download