e65bbda2faed4de1faa7d932f6c490057c4754eada487a764d5e7515094b872a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Size 494KB
Sample261027-hzyceach86
SHA256 e65bbda2faed4de1faa7d932f6c490057c4754eada487a764d5e7515094b872a
MD5 c6a43840f44973aae396af7ad3a7a653
SHA1 4be1570599707f4fa339797b39d1e8d11f526053
SHA512 f09fdb129b75cc411f6b570d909353db70da206b8f2342510c3a2ca46125723bb95b122c48bd2346103e29b911c4d42dc5aa28d667da47dda82266393ad3bb46
SSDEEP 12288:GaoVmp+j4YdR7IKucTm3RhMfoSBjA9U2Yxh+ZgYiuWXg:GDVmpo5R0fcT++foSBWU2YxhkgYiuWXg
TLSH
T127B49D2138F08473D0B685354FE1DA36A679FC7116218DEB93A06F4D2E32A819537F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4624	microsoftedgeupdatecore32.exe
1656	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3580	4688	WerFault.exe	87
5476	1656	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdatecore32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1656	eventviewer.exe
1656	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4624	4688	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	88
PID 4688 wrote to memory of 1656	4688	2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_c6a43840f44973aae396af7ad3a7a653_amadey_cobalt-strike_elex_emotet_icedid_luca-stealer_njr.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
  "microsoftedgeupdatecore32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1912
    3⤵
    - Program crash
    PID:5476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 1396
  2⤵
  - Program crash
  PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 248 -p 4688 -ip 4688
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1656 -ip 1656
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 ce89c85f445191b5889c9cc14e61114db338d7825c46892b8e2cbc3a0518d0ef
MD5 32223bdc20520b2d35dc245f97f6ea06
SHA1 6f8167e16a885cb48edf98b524231ed8f0058bf3
SHA512 28674c8bfe0902aadd8a7c51d0dc9e0259864af64342aedec010beda8501f0b767a7f4a283ba6c3c69baff8f26acd852ca32e58d3393ec61fd2d3db78b8a806d
SSDEEP 3072:khnmUgAZMwGwQnxDrNnIBAfnhJiZQR0ysMlpm+M4:k+GkNIB+nhkZNF0p3z
TLSH
T106140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 29833b9d16ba7f1e9f13fa68a29861ff20fc6f93b3b842fb71e85626a7548b29
MD5 cbebf5dde738dc7bea204d4bfc4361cb
SHA1 6bf5d7e366a04d4479a562771cbffd46a46f8ff6
SHA512 cde4f772fdf372e7e567cfbbfea18566a4f6844ce9ce84b09e05d7a2c45240a077d81e35bb5a8d17756df4f84e86842189411d464041ec0df24a08daa033bc55
TLSH
T105C02B081A520214F288037D41D1310197404100D0408F1509F206088617A0D3420C3A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 b687ceff59fb02dd8127a30a3e404e1c93ddb602d27003854397fab40786aaa8
MD5 734f69582f067c1eab82fc7d274bf5de
SHA1 227d91db90a84b5fefe90ac2bab796151a2b2dde
SHA512 a8348d83b3c53e47b7efbfd0f19a7f5118145f552a1418a8109acaf4f283bf66ff2747003103c9d9c3c9080836624c3809aa163519c58933df1f8ba2cb7a1812
TLSH
T1E1C0801C19610515F694437D41D13D0357104101E2418F151AF12504CD56B1A2834C39
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 ccf759ba6b1f3a0614dc44ff54833cb9b68729b8907f3d85eca47ebd1fdc14ca
MD5 e4db41d8caf666a595e4c8042a9ec3f9
SHA1 745bab088dbee8a68da7762c33871d5179a5b87f
SHA512 56a03028e09bf08b30b3beed8f92808102e02edbb8ff8d2e697c28df75b1289a6f0eeb661df1d98e23c69145deb7af7564c15739de40532f8cf22ebcf99bee27
TLSH
T156D0221F2B210332F008C67A01A00A527A404E0EF885AB082FEA130CAE3CF243820C1E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 d339faca1e7e0944c0cbc2ba7f94a9cef2cd98bbff0fc36362fc5e75aff52da3
MD5 06bc2cfcfcf0f50edb220596032f4a6f
SHA1 53cc0289b6b36bf375a87992b7616a16d6441222
SHA512 18e9e33a313d5e8daa0941233188adb70e9f055bc6dca3fcadf47d44ada9290c17fa2a97d10f0b18412481a3a362de4b6c0ebfcd2e94fd5aa158de6e85192dca
TLSH
T191C08C2C1A664A2AF7A883BC12D22D839A208110F3819F112BB12A08CE24F122834C69
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatecore32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatecore32.exe
Size 257KB
SHA256 eb0763b1876ae8b21b35dd8c132aecb94ac811983623ecd47902b8d938c85a3f
MD5 7daa5566b4fb35bf1561ba78a8e14b39
SHA1 fed2634cd5e3a7e725c888d7a3eb112f3946d95f
SHA512 7f3ec67b5e9e9a35e6efe715ef9810a71e5b64c39d8ad87f6d322960103b45c37a3b4c20a26d2fcc1072fad4dd7c4e0dfd3a5fd8dccf96cf1a58d361b2913a44
SSDEEP 6144:klPMoqFKucTm3RhMfoSG5dCd7hjAOe9UmXY2Gh++Cgq:w7IKucTm3RhMfoSBjA9U2Yxh+Zgq
TLSH
T1D044392138F84433D0B2D5B58BE4DA22A578F97256118DFB53D14B4E1E32A829277F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 15a56d9f305e7d39995f8252a05160921f24896c7053d0d72826c0e7374f89c6
MD5 c435638b7e4fd60e1a088ad5dbba1d91
SHA1 f7578842192d8f0241a4d96c2cc03ac3b96083bd
SHA512 d77de7ff4e7ba55c90f826090caec9254eb8a634242717380a5dc7929640e2531652db9c7d7c7de6a9032869ea14e346167229262a9ee9223033533724e865f3
SSDEEP 192:dqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:dqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T11842C67B5821842225F1515F7BBFB208E066F2079541DCD1BE8C43051F927ABE5B2E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 b2296e3b7a72b4542db73b5d3b5194cd5307cb2d2e220dfa31f56ba77c9b0c32
MD5 ee00b10684f5a8d42c3349ac3605c2c0
SHA1 97478306be6671274cdbba0de311907bc07885da
SHA512 c28be56caf06602b927b15940bd38762f83a69ed779545d2a41124e909433319c8f57c20c8e35e74bf52cf4d7e9828f50651803cd005fc01b3e6ad6dbfda7d3f
SSDEEP 1536:724HyOTCasJY2asmyvmRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:71SOTV6TXpWCmAZBtRb1BAwMW
TLSH
T1AA24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download