6ca79ca9fbe1b9ca31e3a845363d4ee2ef82aaacf36fad80bb1072d1ff4ccd1c

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_01329a4bac64a8e8d7d0b3f201813dd8_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm.exe
Size 7.9MB
Sample260420-n2vxysht2m
SHA256 6ca79ca9fbe1b9ca31e3a845363d4ee2ef82aaacf36fad80bb1072d1ff4ccd1c
MD5 01329a4bac64a8e8d7d0b3f201813dd8
SHA1 8051a9acdbc727d5bfe68e424d8aeeac6a50f549
SHA512 97203d55ff183349b8a16e20905fca19e73b825d834af671245d52eb2392f0f071af4030f05411d58514e971716263adaed7e513604677cc97573e42be32b8a0
SSDEEP 196608:s3KWQc0gEYnvLhCKj3KWQc0gEYnvLhCK7Ojn:JcZEIvUpcZEIvUSOD
TLSH
T1F886C00177D1C032EA7715324A6AE2615A7EBC210F2297CF23881E7D6F716D0AB39767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_01329a4bac64a8e8d7d0b3f201813dd8_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-20_01329a4bac64a8e8d7d0b3f201813dd8_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_01329a4bac64a8e8d7d0b3f201813dd8_agent-tesla_amadey_cobalt-strike_darkgate_elex_glassworm.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads