77f4ad8a6da33018bf3e692a524247e27ef9acb91cdbce4e84a8b1fd588eff25

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
Size 17.6MB
Sample260418-2qdfeshs9l
SHA256 77f4ad8a6da33018bf3e692a524247e27ef9acb91cdbce4e84a8b1fd588eff25
MD5 3166201acb60c6fdde03c9e40734f037
SHA1 387e1b4a350ca8c458fa01804df8e5743ea595cf
SHA512 349a34fae59865d6f08f812da1bb68bda2489150f395d1cbfac225acacc18f73738dd08e437f538af3f65145acfbe66a89154dac772da53d2393099a53fdd8f3
SSDEEP 393216:wXcZEIvUYRXcZEIvUYRXcZEIvUYRXcZEIv:wKEIvVKEIvVKEIvVKEIv
TLSH
T1BE07BE1277908071E5B229314A66A22D577DB920CA238E8F13941EFEFFF15D09E39736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4292	2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
4292	2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3166201acb60c6fdde03c9e40734f037_agent-tesla_amadey_cobalt-strike_darkgate_elex_hawkeye_h.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4292-0-0x0000000000990000-0x0000000000A2C000-memory.dmp

Download