a4d6d5684be72227106ab9c7700e9a3e78462135e1ecfa8e3aa1ba0cc316373a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_39162f028f003cfd05b2efab7b81d687_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 2.9MB
Sample260522-ssrldshz2x
SHA256 a4d6d5684be72227106ab9c7700e9a3e78462135e1ecfa8e3aa1ba0cc316373a
MD5 39162f028f003cfd05b2efab7b81d687
SHA1 722580f74b337fb3dd9a87692cc3d7e076e36ad9
SHA512 9303a6a2d485f0e016319878e9dc2496bf6556d41e009c6a29539fb6aa2727eafadf8ad67c3eca3199270699b26111c0f16ca60a0ac47e8cc11ef486ee18db38
SSDEEP 49152:LV7uNRXNxDwnNTBXrOO53RTqtiPfD0ljR56rDy6i1zuajsauZjae+gh2l:J4R9x8drOO53xrDtdK
TLSH
T16DE59D2177E886B5E1BB45308AB586269576BC311F3187CF63948E3D2E326D0AE35F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000400000-0x000000000059C000-memory.dmp	UPX
behavioral2/memory/5012-2-0x0000000000400000-0x000000000059C000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5012-0-0x0000000000400000-0x000000000059C000-memory.dmp	upx
behavioral2/memory/5012-2-0x0000000000400000-0x000000000059C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_39162f028f003cfd05b2efab7b81d687_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_39162f028f003cfd05b2efab7b81d687_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_39162f028f003cfd05b2efab7b81d687_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5012-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download

memory/5012-2-0x0000000000400000-0x000000000059C000-memory.dmp