ad940d1966a32290c0279633e76df116e8d60f1925ad11b7a459719de07bc574

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample261027-yr2b4agv4p
SHA256 ad940d1966a32290c0279633e76df116e8d60f1925ad11b7a459719de07bc574
MD5 fbd7bbaa35b32d29e65fd3ee316feda2
SHA1 8686bdd374224c1391239ba3a1d7522ef26b6088
SHA512 53416372617e8b860090ded71b94a3fc7c3a4c58082b03af96126383c73511082cb709f11b0d22f95031dd6d16ddd4e10c0ae74fd1ab4eb134daa5be281b7bf3
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXc:GDVLa5S0vHyyLj8trn3wsliuWXc
TLSH
T190F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4532	jaureg32.exe
1680	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1488	2900	WerFault.exe	83
1636	1680	WerFault.exe	85

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	eventviewer.exe
1680	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 4532	2900	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	84
PID 2900 wrote to memory of 1680	2900	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4532
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1888
    3⤵
    - Program crash
    PID:1636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 1620
  2⤵
  - Program crash
  PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2900 -ip 2900
1⤵
PID:2200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1680 -ip 1680
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 72a8acde457b3843c6b813caa1c1756c7782c03b55549dbace20d44a9814daf1
MD5 f5d12665d9282760bff05d65941507bb
SHA1 230812857d47df194c75723af73413e98eae0cc0
SHA512 87c7a546b5f3487ba70a0f0c70a8b50492178a64b994277ee09f0d981cea0840772ac0de4f0a9de2f98f40787ed693c7aeb1d6c9f9f75160c4b47df59249d31c
SSDEEP 3072:VhnmUpAZowGwQ8xDrNaIBAfneJRZQUhbsMl+m+Mx:V7MBQIB+ne/Z/I0+3y
TLSH
T16B140C282DBBB1619E0ACDE24CE6AE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a9d415ea86f992ea29318f459a20db3c292326c9983722400a010debd8b9db8b
MD5 ffe8c61ac4cc6266e0e0fd742221eed6
SHA1 05beeb42b41dfccef87b8fd747a54173006567da
SHA512 218046af250b6951c6cf55999b81d931823c148d0b89695a6e652317479b0bfb57fd9949afb0be67a9db961ddb855f67c2bd2e55799c3445ac2f302720d25eea
TLSH
T185C02B085A520210F188077C1180314187404580D0808F0505F1060881179043430C3A
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 a8b9cab03a2a278cb0097d0156dc6c527021ffb41620d7422a2e6bf08533b676
MD5 88b72d7fa8792105e429d233f1c71b7d
SHA1 dd2376d29bb9f8a7227cf9b19c93ed34cf813a40
SHA512 1849d9c9c4f01b9ccc59473a4a82bad3b30acc810f6b77610f05485b6834880a475748e6484ab2ee8c2e772b19600db2547088d69ca6be68d7acd186366d9f53
TLSH
T12FC08C1C5AA20A16F6A843BC12C13D439B208581E2818F052AF12A48C996B162838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 f7647eae099a7eb3f84a65772bc799207823298934f81a0db57dc283e34e1b45
MD5 8e9a2fa125c2ceeb0ed9192e0c8ad138
SHA1 c025219c7d46ceaf3ce35d594f0d197e2844f4fe
SHA512 7407d63660d7f3823a0a33ed6626b2fc2789fb4bcd0e454dfe56b8dfd676d29c59e13ce8d220188c959c013a1abd6e86d25c25747d010ce2a94e52a900fc82d2
TLSH
T124D08C0A6B210226F15CAB79D69207C2F6D04200F2919F4925FB264ECD2AA8A6E31D0E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 6413498e68c629dc9402d54aa17c7a51f9b756d9c1011c1e90cc747408584cf0
MD5 43dd48c8b8648c7488500e9618f5edc7
SHA1 28ce90c77c1ab4a157775cc3501d79ed194e90d6
SHA512 cbdb333143c2b4fa5c4aa6e80a97faf0e4ff38e508a12ddd7bf52dd93aeedf8b7ba824dc0b69caa78cc5cd36d5190a03aee3aa0915b341cd31e5d0ba161d70af
TLSH
T114C08C1C06650607FAA883B812C229839A208110F3819F0126F13A08CD24F222834C29
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 6bc0b59ff4ff72bfab32a307d17ff96067f33760524df285daf0ac404c0387a5
MD5 7cee3c105718d6e7a6e3386f3086f5a9
SHA1 04cae0494c0df9e76abe4a0250b82ce07ffa2c57
SHA512 b7afda842598cd6be16faa1c23f66a3bfce9be5e6039430da4376895cc1eeaf225379a03e582555bc586fd51c51dbbae3ae20b33136f30e4290430f2616b8ff7
SSDEEP 192:PqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:PqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T11842C67B9821842226F1525F7BBF7208E066F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download