82bca80278b71c7e71dc4e67d57f43a1e10d4a84d3f256dd279d514af13a59d6

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_2fedab2d398f3b7ab17af2c71337a8dc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
Size 65.6MB
Sample260420-e8jntscz8z
SHA256 82bca80278b71c7e71dc4e67d57f43a1e10d4a84d3f256dd279d514af13a59d6
MD5 2fedab2d398f3b7ab17af2c71337a8dc
SHA1 65d6f61fcb1f96f29e16f27fa38d8cf1a408c142
SHA512 88b499870ec0e5387b49b26b5ee349e881bb37218cc904329b015023fe24806dbe2e9bdcc332b950f0393541bce264cc61d1c58c7da769b1249d02efa0fc4fa1
SSDEEP 393216:H5x265x265x265x265x265x265x265x265x265x265x265x265x2:H5l5l5l5l5l5l5l5l5l5l5l5l5
TLSH
T1A0E76B1176D18032E5B316314969925D5A78B861CB338E9F338C2EEDBFF05D19A36B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_2fedab2d398f3b7ab17af2c71337a8dc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-20_2fedab2d398f3b7ab17af2c71337a8dc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_2fedab2d398f3b7ab17af2c71337a8dc_agent-tesla_amadey_avoslocker_cobalt-strike_darkgate_ele.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4528-0-0x0000000000BC0000-0x0000000000C56000-memory.dmp

Download