f10aa1b8814470d2f120a2efb248e4802df4cc9f6d790c262befedb9af98634d

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/05/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe
Size 50.2MB
Sample260507-mgv7jsft7m
SHA256 f10aa1b8814470d2f120a2efb248e4802df4cc9f6d790c262befedb9af98634d
MD5 3e0c8ab1869481f9d67801411636c6be
SHA1 28fea60aac66cd707a7abef56948ed8bacb2b92c
SHA512 26733de7e672b0d189c2558dec04620bc5c6813b5925d4440d5cd1a749eff7422f7301d2940daba9214e532f6111bb41436e5ca6aea5f180099d5a364d64dd27
SSDEEP 786432:qe59e59e59e59e59e59e59e59e59e59e59e59e59e59e59e59T2:quuuuuuuuuuuuuuuuT2
TLSH
T171B77D1177D18032FAB355314A7A925D5A797C208B238E8F13842EEDBFF15D0AA39736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2896	2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe
2896	2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_3e0c8ab1869481f9d67801411636c6be_agent-tesla_amadey_cobalt-strike_coinminer_darkgate_elex.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads