92a8028e1efe77072056e4f0e7c59d6fa92ff9c0da7aeabb6d225c6426f38e71

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Size 405KB
Sample261029-efrhzag17s
SHA256 92a8028e1efe77072056e4f0e7c59d6fa92ff9c0da7aeabb6d225c6426f38e71
MD5 e3b630dda17ccd4c46bccdcc39597df4
SHA1 4eeb9ac5b7d0d8f10b5c2b07a8a6a3c8220a3a3f
SHA512 144e1c54dbb289e461af004bc6c071f15c5c58ab1db047daafc2bfc63233116c1bb9e46da78ed0fcc0aba57aae79d1b564264132ece330a559c11e680a2f728c
SSDEEP 12288:GaoVql+84Y0ImGUcsvZZdubv7u2l35iuWXv:GDVqlzYxGBcslpiuWXv
TLSH
T138947B1136D08EB2E5AF043049B19A719A7BFD301F219BCB63947F593E306C19A3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4920	armsvc32.exe
3176	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2916	3176	WerFault.exe	90
5108	6120	WerFault.exe	88

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	eventviewer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	eventviewer.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	armsvc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3176	eventviewer.exe
3176	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 4920	6120	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	89
PID 6120 wrote to memory of 3176	6120	2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_e3b630dda17ccd4c46bccdcc39597df4_amadey_cobalt-strike_elex_emotet_hellokitty_hijackloader.exe"
1⤵
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
  "armsvc32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 1604
    3⤵
    - Program crash
    PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 1492
  2⤵
  - Program crash
  PID:5108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6120 -ip 6120
1⤵
PID:788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3176 -ip 3176
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 192KB
SHA256 f5a3935453411b92b2698659eb1c339578184988da915e731579e5c9e562cf2d
MD5 0b7c472b188381a4d0e006c498228e44
SHA1 7f132f189ad0c96c6ed24cac5a97837f6114c7a5
SHA512 b5e8d844dbff15276ac97b140886da3fd93d8fcb424eb0aefafed78bf31252e4b3b6e8144baad5c0767cb461678791b715190bf1347c76d132d13c6d2b8bd617
SSDEEP 3072:cnmUNAZowGwQlxDrNHIB6fRqJRFQUCbsM4Fv+Y8:gMKdIB0Rq/FII/Fm1
TLSH
T1FC140C282DBBB1619E0ACDE14CDAAE5646FD719F21027F1B4EF4AED01D436BB8E17440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 4b056dcebfdb597a2c9a5d62fb243447005e1901bf531b4a2293cb045d508730
MD5 3a26b2d79c57f81ea8c3b07d9f0fd462
SHA1 63cdfe6edbe9ff583a06052ce4865cf3642a6c7d
SHA512 dc00101ea52ca1dbe08ab976d2b06340c84e0e24b993e9404c149e0868d2b8d329b5fb6004c24f2ac678567ddca772fff6043ca3132a5b89db823c73c6684e61
TLSH
T119C022082A82A200F28C83BC02C03202AB808200E0808F8A0AF20B08822BA0C3828C3B
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 2d3eecfae3acafe2e13ec44aeca3f5ee07d75f10bd0d8f71978ae1128c861002
MD5 81e0c4395b827bfb8a1b2cf8d27048f3
SHA1 cb170f3895403d4b09c9dc21a52b457f4ee10289
SHA512 c4e230dfffdc145545a425278b84ae8991b32e574d2e4748a6f141f9ee7f5e56ae173a92d421cb568f233d3e6297cc5a558ca7a5cd0e04db292fb1a99c1c2900
TLSH
T10CC0801C19515505F198437C01C1390357104101E3418F4516F13A04C957B192838C3A
MD5 SHA1 SHA512 TLSH

Submit Download

8CE4A33FEB8CD35F8F6C8D2BE260E617

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
Size 246B
SHA256 baf01822e139eb42c924814019b27fea4db9442e35740a226c9bce6fa29fc516
MD5 9d5532a50cb423a3afd9168351030508
SHA1 276c5a4da562bedcac64a4dc4b669a437c292c4c
SHA512 bd3e8d7e79ae3be8326f091e331acfc319e5486f7cc5e1c2048bf60059e77bd46bbcdfdfbf9098018767f327d72074e1ff40f85bca860f27e5c7bd5125b285eb
TLSH
T1CFD08C2C2B52022BF0B48B79C8E103C20FD42251FA908B0909BA578D882FF132C62C0F
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 aef669a88de1ad293131e9f08120402c06c6aa533318b19be34dec3bf48da1ed
MD5 499a1d2698db6f45480e2bbca9f309a4
SHA1 46eebd8509da82f2d55f65ff0793ebd73c02e336
SHA512 cfc8c9f83e6c2f6d1494c25da3b0e46710b08707b38b8dfde8b5b17057e7ac07e89853a22d494f048f82b10ac00440e4f9b9192c987c94b4630ae4db593ed8f3
TLSH
T18BC08C2C06614606F2AC83B902C229839B208210F781AF0526B16A08CD65F122C34C2B
MD5 SHA1 SHA512 TLSH

Submit Download

armsvc32.exe

Path C:\Users\Admin\AppData\Local\Temp\armsvc32.exe
Size 168KB
SHA256 6af57a7da31749715ba29b3b55a2f4acdd53a72b4f179398d2bca80a6c4f4841
MD5 0b6178b0febd39f9abf211b13dcba2d4
SHA1 fd868c3e3cb3d54d8e7286519a3a217caed424d0
SHA512 c299290115abe25ad1238b9cf7928dbf3665e4f6b71d8585549df276e7961532887eeb62c831cd6d179d0e031ca40057c28780eed29b23c8e1437e37a98bacdb
SSDEEP 3072:heC76JNKjzDImGnUI/9FXK4+PoSZSb5qURwubvvnzdl1C7blxA2Z4l361xM:hROJyDImGUcsvZZvUmubv7ubHAZl3H
TLSH
T151047C2132C084B3D9B3193059B4DA716A7EFE301F708ADF6394176A5E702D29E39B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 28KB
SHA256 4ad79ab771dcab79f47e21ec6bc8d7fe781aced72fc4e6db2eaeaada64f75940
MD5 f20766a8c2d08ab048ec5bb58d6cfd17
SHA1 cd7d8a5be513045f57f5df3b27c7192ae831a527
SHA512 94bddec50f287b75854637f823b9924651922edd5380f079df3f1841a4319a5bc93f2acd44a35624d2e117144592b44033b57f502876129b8392d517f995c2e9
SSDEEP 768:bqQmVAz24xtyOdIzIYu6MpV4a8IUT7qH0/A2a8IUT7Y:124HyOTCasJY2aso
TLSH
T1FED21B7B8724087565E3034A6FBF7584B855A08BF502D4F4BAAF26052F83EB68473E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redevlist.dat

Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
Size 206KB
SHA256 fef406cad7e785dcf6a32f76a7627025c41d880e365d53ffa139ea109f6d591f
MD5 9e94908d77c21ae9794d4e1f71cf9d0d
SHA1 feb66025fe4db65090c834ed1be752f4d3682f7b
SHA512 7a24069abc364f083fb092ce3d308cf3b62c7c9b4eaf55dfa4b117562bb874bb606643a4cdeb80f330040964dc2416004385eaf8df91cf336b264cb85e624f3d
SSDEEP 1536:124HyOTCasJY2asmyvXRUOyhFOQpbHtp+wcQkM4cWSprqPnOEDkLZBtMascblXNv:11SOTk6TXpWCmAZBtRb1BAwMW
TLSH
T1F724287153F009BA60C343A8BBA576697D66D14BF513D0ECF3AE42112F83D668837A9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download