bf760c1705aee9ef729f1a88fb1a7b37d931cb857cc92322caebe020cb12d25c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample261027-pphmjadz2j
SHA256 bf760c1705aee9ef729f1a88fb1a7b37d931cb857cc92322caebe020cb12d25c
MD5 899218a805a2f5523246b6ca459c392b
SHA1 7c96bf3cb3756cac599f50ce56d6cd0094cbec43
SHA512 f6e237c62d53ef0a97e4da430caddfd623bc6e6c39c3c9dd46316d4b1e8d28056fd6e71de3c4314465e86050b2039f3897ce39bf651511c5fd5aab07b3c7ae68
SSDEEP 12288:GaoVqB4Y5ImGUcsvZZdubv7u2l35iuWX/:GDVqBFxGBcslpiuWX/
TLSH
T1EA949C1132C084B7E5A6153049B5AB719B3AFD701F318A9FB3547B1A6E307C18A3A77B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5160	armsvc32.exe
2924	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4748	1556	WerFault.exe	87
5516	2924	WerFault.exe	90

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2924	eventviewer.exe
2924	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 5160	1556	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	89
PID 1556 wrote to memory of 2924	1556	2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_899218a805a2f5523246b6ca459c392b_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5160
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 1588
    3⤵
    - Program crash
    PID:5516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 2012
  2⤵
  - Program crash
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 1556 -ip 1556
1⤵
PID:252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2924 -ip 2924
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 5KB
SHA256 1f2719b100fcc59601f0dbb286aea5034e05bae881425792a115106e244a0ed0
MD5 b10207f8ae69cd9d6daadda0c9d010ef
SHA1 fe195f301116e55b87e1924b93b2d2b906dc572e
SHA512 ff80b70243a5bfe50a3f52eab372042744f7722e22da4be6ed58849258a8cdf4972e654dad78b5d35aadd9e9f7cecee6cbbeb40acc87ef5d39f35438d8c369af
SSDEEP 96:05eywtHRbQ6aOfziJ2WP6s2vYYdn5+PuBttUU2js/OYXgvZ9hkJ4FLUHswb:2e9vIOoPX2vYa5qV1sSv3Resi
TLSH
T1CCC19E94E8F7DC4FD8639F3401AAF2255508E25F4423B71D7081A82B76E2B06330A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 193KB
SHA256 755d73c2b66092f727e4bb5c14b859fb2e54f4f6c615a7d0c396a2e8b2767f5d
MD5 21d9dc4c15691c9c73b5eda3f060963f
SHA1 069081363065103b752e4f1b22a69343b1cf8f9a
SHA512 38a2d0e9b5499585a50b90e802632650f0d8c3acf5e91f7387258c74b951c50ea6c418b99665728f03e88571c54ccb078a368a0515abcd451eaa80ffcb0a13e8
SSDEEP 3072:vhnmUoAZMwGwQnxDrN5IBAfnhJRZQRhysMlpm+MP:v+GknIB+nh/ZaF0p38
TLSH
T13F140C282DBBB1619E0ACDE24CDAAE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 6bcfcfaf46babbfb10c053b4b50f68e68bf5814cac82fc0189db8ae16db880c4
MD5 ed24e2f4636163a988c26a24e287ee6d
SHA1 6dcf2acd5fb6809975fc4191c44cab3b3d41bc6f
SHA512 04b6723c0def4ae058fdf77b4e1e81171381fea8500a8a03864fa7d72edb2111359c99be53d74841f279ba3a3e8f7783ab6e79537a0f86e6e4d7f9f511515c46
TLSH
T1F3C022082A832B00F2C8033C228032028B808202E0808F0A0AF28B088A2BA0A3830C2A
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 6d2a3ea60dc104cfa45a44d995b235fc261b7cf1a7328934221668c2135c5e91
MD5 2ebbd7230ba71a3acc7275a0c792f481
SHA1 7c096bf71210b0c5fba6bdf4dde3c556682f1a79
SHA512 1e5bf426ca7a0aeafd0e840f883b8283c1bfc00fe0720c7b9e1e4d0dc6c9b1f312e2ffa876213e67cfaeefb0f71348be46b927a936021c93d2a699a52ed19e3a
TLSH
T113E05E627BE81215E6730F3CB972A5854A77B6676911CACD0674004D5C35F21C83771A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 4b4143b5040e4e4e9abbef0bb606d738c2f5e2c1da8830954565c03dbbd7fcb1
MD5 51c495394443719ed5b4e3a791b7646d
SHA1 63c528e64e3355b50c0b3d33bc121936c136db2c
SHA512 f7a6bbb5b17411d42c78f0409260c90f44efceed9e983914b241bfdaa2271c0a2510cd697716aaf4a3b6c416a05709a59198c7be24eb5859b9abccdb355b2398
TLSH
T180D012382F600136F290467E48628E416E91256FB992DB996FEB5A1A5C3CF510D72C0F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 b57510a096c804e396de6d685bf9f4e2d716497d69e766b196f70dbfe08dc2f0
MD5 adae2c3fcda47993b2dd66d70253fab2
SHA1 5ea5f50402cc6ef6a58e21073b19f6dc1684c1f0
SHA512 55c4bc72f52821f398939ad326b77f142500372a82ec883811757608daf0047b9b4fe6b62361c1d32165dabc3cddd7ab1f86dd76f8314a0a0c4a5beee86c23a8
TLSH
T197C08C1C07650606F2E883BC02D22D838A208111F381AF812BB52E48CE25F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 8f34b82b39b3d16e15e5a3c40d3bbb1daf03babd80833e2da7236cc9c226e6d0
MD5 1930f244ddbbc2d58c183a73dc611a57
SHA1 29122aed6b2385f1201089e58b5a042bf0ac2cb7
SHA512 70f5e979f896677a054db29ee4fcf95c1d323e3ac0984d71d796bd0093e516efa06cfff6e5bd2a3e61db1cd927514c6f5aac45bfbe527ea00629e5106d43046c
SSDEEP 768:RqQmVAz24xtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7Y:/24HyOTCasJY2aso
TLSH
T1EDD22B7B8724087565E3034A6FBF7584B855A08BF502D4F4BAAF26052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 4b175c49580c924b111a368d2ed6f610cb50b846707490cfb9549f3ec9cd8175
MD5 a43c0fe69d968ae9395374745d5a3694
SHA1 379195bdfc10cb2492394622300c735b1ee4ad6b
SHA512 60b244aa2e20ec0d05f2f4c35dc99a38a063d1d65e855d11e8cdf547574347699b04a27c7eb8ece0e1c224b83a0b0f19c5b50295d52c5902bec23175f4b107f8
SSDEEP 1536:/24HyOTCasJY2asmyvORUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:/1SOTh6TXpWCmAZBtRb1BAwMW
TLSH
T17F24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download