bf760c1705aee9ef729f1a88fb1a7b37d931cb857cc92322caebe020cb12d25c

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample261027-pphmjadz2j
SHA256 bf760c1705aee9ef729f1a88fb1a7b37d931cb857cc92322caebe020cb12d25c
MD5 899218a805a2f5523246b6ca459c392b
SHA1 7c96bf3cb3756cac599f50ce56d6cd0094cbec43
SHA512 f6e237c62d53ef0a97e4da430caddfd623bc6e6c39c3c9dd46316d4b1e8d28056fd6e71de3c4314465e86050b2039f3897ce39bf651511c5fd5aab07b3c7ae68
SSDEEP 12288:GaoVqB4Y5ImGUcsvZZdubv7u2l35iuWX/:GDVqBFxGBcslpiuWX/
TLSH
T1EA949C1132C084B7E5A6153049B5AB719B3AFD701F318A9FB3547B1A6E307C18A3A77B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4132	armsvc32.exe
4124	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3888	4124	WerFault.exe	87
2148	784	WerFault.exe	85

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4124	eventviewer.exe
4124	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 4132	784	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	86
PID 784 wrote to memory of 4124	784	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4132
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1892
    3⤵
    - Program crash
    PID:3888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 1324
  2⤵
  - Program crash
  PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
1⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 784 -ip 784
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 755d73c2b66092f727e4bb5c14b859fb2e54f4f6c615a7d0c396a2e8b2767f5d
MD5 21d9dc4c15691c9c73b5eda3f060963f
SHA1 069081363065103b752e4f1b22a69343b1cf8f9a
SHA512 38a2d0e9b5499585a50b90e802632650f0d8c3acf5e91f7387258c74b951c50ea6c418b99665728f03e88571c54ccb078a368a0515abcd451eaa80ffcb0a13e8
SSDEEP 3072:vhnmUoAZMwGwQnxDrN5IBAfnhJRZQRhysMlpm+MP:v+GknIB+nh/ZaF0p38
TLSH
T13F140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 bc3736ac4a8c9812be88094225937a199cd23569fb1b24b58e5763974c74fe91
MD5 1b6be098b9cf983b8e85bc2f9d038011
SHA1 568ee9d16f181482888702d3559ea561bf4b0f34
SHA512 142e64ebfa02126bacb00e812d045b7400d7e100f57d7f6477c5ed5542a33249fd00263796c8d68efbb73249a59e3669717e1f3d99425a2f58de4d873b441cd8
TLSH
T1D2C02B081E520310F18C033C1290310187404101D0448F0509F1060881179063830C6B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a94431be2437ad151d26d045decf308fb6ced3779127c835789aede8de1405ad
MD5 d7b21a3f7f3f392a23092141dfc067a7
SHA1 4605d50a8f732a1c4e33d329cabc405754d45cb6
SHA512 5d51e8013401e7bf15ff011130abd0383f0c81dfc6ae0267208e7e7e3fc047febe3ae3e75b076268133d727dd212130e47d67c6eb4c70b03fda6773ca40d1aa6
TLSH
T138C08C1C1EA20A16F2A8437C12D139039B208102E2458F052AF12A08C997B272C38C6A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 c2dc3ffef3333dbf7b2136afc702b95980b8b724e20f7de66f7b20854183d4d9
MD5 46727184679c9f3bbf9d0e1f2c14e29f
SHA1 2a56013e1f30d47eb6a89b95a5f22d72e602f854
SHA512 5edb4320f5f6792e5a9ebdb7f2d690f4bc8e922bd1213219d2ebdf5673fda8037b2b0288c4cd8df6b2e845ac5ee04b06d94b8fd4818a23669b072c540d1b68f5
TLSH
T10BD08C283F610239F281063A48638A416E806527B1929B8E09AB530D9C3DF820D62C0F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 ccffe7252cdb2c6c213ebc3ad3d4dad1c1014236f3b8cf3e9b49c43eaac10f76
MD5 da6ee77ffc958d673ec4cfb2f4f43de7
SHA1 dc85b36a5ce6a89cd0f9a9b2da0a616a43874ecc
SHA512 8019720887e0ebf7b4c1211c0cc0e4e7cc0916d772e646515093591b3575ef9765e171a2b80ad3701ae00e37ca8a51ddf1e325c3e4a5a08591209305f3ea22de
TLSH
T18DC08C1C0A620616F2A883B812C279838A208111F3819F012AB12A08ED24F232838C29
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 66a19e4ce34ba8634ddbdacb701e7aae8253aaf91a0e64cfa93234dd84fced50
MD5 97839ce011c8c0dc0ccc53299c910ba7
SHA1 e9410452281c1717f6fd2d9a33d3b71c38a2be0d
SHA512 d3c4263f10ec6f646e01b04da9a5bb5a079458f38664fdcb43bfbdf287326e0a73f6b90f9015777f66f793ebb4a9cfa5abb4520eb80d8b0f5b6dc6c792b4c6a4
SSDEEP 192:RqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:RqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T1E742C67B9822842225F1515F7BBF7208E066F2079541DCD1BE8C43052F927ABE572F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download