ad940d1966a32290c0279633e76df116e8d60f1925ad11b7a459719de07bc574

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Size 751KB
Sample261027-yr2b4agv4p
SHA256 ad940d1966a32290c0279633e76df116e8d60f1925ad11b7a459719de07bc574
MD5 fbd7bbaa35b32d29e65fd3ee316feda2
SHA1 8686bdd374224c1391239ba3a1d7522ef26b6088
SHA512 53416372617e8b860090ded71b94a3fc7c3a4c58082b03af96126383c73511082cb709f11b0d22f95031dd6d16ddd4e10c0ae74fd1ab4eb134daa5be281b7bf3
SSDEEP 12288:GaoVLa4Ydh00vHyvTCXdXikLj2jR7trg6Qi3vYsKT8iuWXc:GDVLa5S0vHyyLj8trn3wsliuWXc
TLSH
T190F4AE2135E0C072D17601314D6AE7A4977EFD704A3289D7B7D4AFAD3E305C0EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3624	jaureg32.exe
5136	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2188	5136	WerFault.exe	91
3064	4572	WerFault.exe	87

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaureg32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5136	eventviewer.exe
5136	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 3624	4572	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	89
PID 4572 wrote to memory of 5136	4572	2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_fbd7bbaa35b32d29e65fd3ee316feda2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_luc.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
  "jaureg32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3624
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5136 -s 2104
    3⤵
    - Program crash
    PID:2188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1500
  2⤵
  - Program crash
  PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4572 -ip 4572
1⤵
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5136 -ip 5136
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 72a8acde457b3843c6b813caa1c1756c7782c03b55549dbace20d44a9814daf1
MD5 f5d12665d9282760bff05d65941507bb
SHA1 230812857d47df194c75723af73413e98eae0cc0
SHA512 87c7a546b5f3487ba70a0f0c70a8b50492178a64b994277ee09f0d981cea0840772ac0de4f0a9de2f98f40787ed693c7aeb1d6c9f9f75160c4b47df59249d31c
SSDEEP 3072:VhnmUpAZowGwQ8xDrNaIBAfneJRZQUhbsMl+m+Mx:V7MBQIB+ne/Z/I0+3y
TLSH
T16B140C282DBBB1619E0ACDE24CE6AE5652FD719F21027F1B4EF46ED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 436edad9f134452221771cc327bed16f792cdf9007ad1bcababbf6a05d89f464
MD5 3633cae327fe1479ca94ce19af274b5a
SHA1 b45dbb5dba6f4f5b7d49a9377cdd1a18e72c3475
SHA512 7ca557414877709d3ac90d23fa21438ee383ac00dc7da45088d217bc0e34fa198982cfa234104ab47166fa0b7104024991dcfdf4e8010c519f946cd7a37565be
TLSH
T138C08C1C1AA20A06F6A843BC12C139439B208101E2858F051AF12A08C997B162838C2A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 acd6447ec3ad89ba25bc8e7493212927d9ea9ff859dc3d1855b6607b278d45b0
MD5 98958a270e58714bfcebc66246d4d2ad
SHA1 db631eb0b82caaf9ab223cc7467ca9b1950c99e8
SHA512 7604abf1a6263be0ea7b8b7e8ac0710bb84824fd41e1ebb099f8639061a7ea1deb2b6adc5b80b019a43c7b38034f0adaaa5eb664f26116c3cd93e1a4fae464ab
TLSH
T172D08C0A6B210226F15CAB79D69107C2F6D04210F0A1AB4915F7264ECD2AB866E21D0E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 3aa1fc22d6937e60ec885554865ce798bb6e0355a8e39527228305e7aa1473cd
MD5 01fdcb1e5dee55aa4adce812274290a0
SHA1 c77e99bf6c545be7fff6b18de4a6852c5099c1e7
SHA512 ef2bb634bb1a77cce8cde38a5cdeefb8a45de6bd4f928e13c98443820e0c9d256167ec621ce5476f8bb404074c536baf81dce5bd00cc294de4f3a08cead30d26
TLSH
T1BFC08C1C4A610607F6A883BC12C229C39A618110F381AF0526F52A08CD64F122838C29
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 5d756e563efbb6a6952d511572f06abbac56d4b0cf96a0f0a5d3d3f19da87a2d
MD5 6352a06919333d3065dd12d20387b863
SHA1 a58286e4ba0ca5053630afe35bbb047aa48ccdaf
SHA512 e83b17c57ca69ea9f12db646bce0ea6b6234b0ab861adfee0d394d4fb599958066b3128d6f29d1099c0619ff5ff8fc23cf0a815d840341948a753123af840b47
TLSH
T1F8C0920C9B524316F68997BD229262C29AA09610F5D5AB1A16FA0A0C9A3AF052874D6A
MD5 SHA1 SHA512 TLSH

Submit Download

jaureg32.exe

Path C:\Users\Admin\AppData\Local\Temp\jaureg32.exe
Size 514KB
SHA256 1eac1f267038a57549a4ee3478f1e32b6dba3e7a07dd6616eb11c661000706ea
MD5 806e21e089327eff35ab9d91c7a7b963
SHA1 66bb3fec08cfaaa142f7b5c261699c7732fd2f37
SHA512 3b4047d15295278f086f95986ce2c02497c099f33718d82e6cde48890e46f3f5f746e899f8168d1b1016277ab5f87654e2a3b364891b2c82003484f7636bc5c0
SSDEEP 12288:u00vHyvTCXdXikLj2jR7trg6Qi3vYsKTG:N0vHyyLj8trn3wsL
TLSH
T1A0B4BF2439A0C032D17311350D6AE794963EF6704F6289E777D4AFBE2E315C1EB24AE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 12KB
SHA256 6bc0b59ff4ff72bfab32a307d17ff96067f33760524df285daf0ac404c0387a5
MD5 7cee3c105718d6e7a6e3386f3086f5a9
SHA1 04cae0494c0df9e76abe4a0250b82ce07ffa2c57
SHA512 b7afda842598cd6be16faa1c23f66a3bfce9be5e6039430da4376895cc1eeaf225379a03e582555bc586fd51c51dbbae3ae20b33136f30e4290430f2616b8ff7
SSDEEP 192:PqQmVA+k2IU4OlV4o73QbyRON1A06OmtzIYCD6Mk1g+dJHICxbN1thfTizw36Hs:PqQmVAz24xhbyO+OmtzIYu6MklJ
TLSH
T11842C67B9821842226F1525F7BBF7208E066F2079541DCD1FE8C43051F927ABE572E9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 5becc5a8ba0b2129d194e200102531b4eb011b278148baafd4fb168049013c2d
MD5 cc3fd3b46e043c3b76d230766d3c2141
SHA1 58d86980987957d701863b6643a1a7803a23aaa8
SHA512 61e235cb09ba6767f41f68f39d8b5524c1d19fc2a51a20cd98545c3f703431521d6afad977603896a8fbda3dde9bcb71748024c37185fe87d8f32da47a1c02de
SSDEEP 1536:Z24HyOTCasJY2asmyvORUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:Z1SOTh6TXpWCmAZBtRb1BAwMW
TLSH
T19C24287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download