2038ca19e1eb3e9ed0282ef970b2ddde8a76716df1374d54c2d359bde90e8c94

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample261027-e483xs1wbw
SHA256 2038ca19e1eb3e9ed0282ef970b2ddde8a76716df1374d54c2d359bde90e8c94
MD5 e25de5c5b5f5084af350e030bba2c7a3
SHA1 91e3beadfd9e7518c246013f76e5b1a8666b691f
SHA512 1534daebc0d28774947c1a8b696d7ba85990eb3a4d4510b65d99e4ee6239abf88f8d4caecc4cd26e89009c82e3efad4d6f7d99c4946399febf8a6603fe917f97
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXP:GDVLa5S0vHyyLj8trn3wsliuWXP
TLSH
T18CF4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3928	jaureg32.exe
3860	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1488	3860	WerFault.exe	91
3128	3748	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	eventviewer.exe
3860	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3748 wrote to memory of 3928	3748	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	89
PID 3748 wrote to memory of 3860	3748	2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e25de5c5b5f5084af350e030bba2c7a3_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3928
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3860
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 1452
    3⤵
    - Program crash
    PID:1488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1384
  2⤵
  - Program crash
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3860 -ip 3860
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3748 -ip 3748
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 1df509631b02e7354012b4fb5cd92ebd2ae90cc28011f0f3492887465df0251c
MD5 f4ef2276e747d460a86eea9b1f6c49a4
SHA1 31277ab11cce0f14368622ab9a97deca079bb3bb
SHA512 6e1cf6e090c721b1597f0bce0ffdb860d1db5d6232f8ffadba94d0b2d189940e5d4e0ea9a77afe3f525f743186f1e7b30e20251bf5084f823c489cc5407848dc
SSDEEP 3072:VhnmUgAZMwGwQCxDrcsIBAhnhJiZQR0ysMlpm+BU:V+G9XIBinhkZNF0p32
TLSH
T183140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9f19f73450bb8d369438796953c9edeaf60860fadf51f0373137db8882b00007
MD5 e12111b3dc4e7ae7900a425284f96aaf
SHA1 a454160133fa15b8cca5daa3f67719506f95bddc
SHA512 c087332e812f3920c58f0e001a745b658b590143bebcbb52bbf213ea8e99d41c2d42e8fdf663f9660f068025ad81ae26f47a25e393253e6994c9307bff7ea575
TLSH
T1EAC022082E820220F288033C02803202AB80A202E880CF0A0EF20A08C22BA083820E3A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 ea0d2f3165543cd39fb3a7c929a37fc5b6a08b793bdba5a5fc1a8fa64e57d7a7
MD5 d8ffe4fa2776d292956b33e59e4ba531
SHA1 9dbc7b5d0e2d98c9d1bde5fef93da7cbd13b023d
SHA512 f6803b04e75835e3b83f208d6b99046089d5ec63cd196f064345abc50414bd8a2fc1fe31ae478782d331a163d6665c9306ebd775a468b6e93f47804dd673e332
TLSH
T1A6C08C1C1EA20A16F2A8437C02C13A13AB209202E641CF051EF12A08CA96B1A3838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 825eb2b603884a45b49d2a00ea4fd6090d1b6ec6e4412e12dda48c7ceeed75ba
MD5 b49ab0af3dccd07e867f552eabb86e95
SHA1 fc911ca3d3b3ef80508f9537071b329b9b74c6a0
SHA512 2c918d03484731b9e5b749245fd4933d585f2ecb17bea7befbdfa5468421c903140ba612900837211b652fe69f71106d34396ea13c5647bb58eaeec922d75c51
TLSH
T1CBD022241F800337F13E473628720A0237D23528F180870F8BA0222AC82992008B2C0D
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d5e490a861afcb774710bdfbf133f1638229d55b5e1268b4a6240da977bc3a49
MD5 47d8fd0990dd2458e1f4bc6af56f366a
SHA1 66ea93ca928d96010ec873f4fe5c05c082bcc072
SHA512 3dd0c9796545205d0f1eadf3f4c8deffc5aac51092b040563bc0d227b5f9f70ba3d701b1c24bf6dd2d4e6dd147bd95b42f4a7ec97422bc4cea4ef7183df56a99
TLSH
T1B8C08C2C06610617F2A883F812C229839AA08110F3819F012AB53A18CE25F522834C29
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 57d065880e1e3d8659344e32e3230a57b0b8205787417c8380b42ae29b0d79e9
MD5 d5d54f9d637a66d13e008cfcb6c9472b
SHA1 8e7b6145516114c894dfa68a90c0f2eb3ab9753a
SHA512 a7352f205869fe95bb3a9090a13f057b5782c7128f989dbf7a02799af767647a7fc310d99b3954642b8ba6981322b8d42cc4c6f10ffd896b6fa5adfc9e93d814
SSDEEP 192:xqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:xqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T12642C67B9825842226F1515F7BBF7208E026F2075541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 df71e39edfde7b7fbd6eb641c2e384fa0d083f5a1c216ea019f31e4078653851
MD5 b94646fc0deb30c01adfa75f950ccf98
SHA1 e31bd6a1165dc9a8726322dd8c90e3b934b2690d
SHA512 dfdcc2327f857eed1a8d23e6798b878fd25fca1c35c7bd307500f111fc9f0a521240e57f43cd23a5a3d350feed79c9f7d77dc13023a6abab0d27bf11e242ccfc
SSDEEP 1536:f24HyOTCasJY2asmyvmRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:f1SOTV6TXpWCmAZBtRb1BAwMW
TLSH
T1E024287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download