dc612716f8e98d4def06672385e44027371e94aa5ded2d6d3d48f42214ecfb4c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_5d5af33feef120ec43c014050c4ec75b_cobalt-strike_elex_hijackloader_mespinoza_vidar.exe
Size 1.4MB
Sample260523-tkp82afx21
SHA256 dc612716f8e98d4def06672385e44027371e94aa5ded2d6d3d48f42214ecfb4c
MD5 5d5af33feef120ec43c014050c4ec75b
SHA1 28125b27ee06bc16f4b4fd95ed4686d492a3bc7e
SHA512 38c4101ed3360f879214e91beb0f9acc72e0d4712386441ecbb40ee855dcade44385570e7069cc295166cc1996dc87820f73bd332f261b6cac93c55a3aaeefbb
SSDEEP 24576:GH35DMw2n/qIjtAT3Gf2ROf1IegqutJQ5FeQzcuC4r6HQ2QRlrYwZCUm:O35DMnCIjtAyf2RAR5FeA6w24o
TLSH
T17665491177A483EDED775231C9A6A236E675BD201930F34F124CE64E5F72E809D2BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_5d5af33feef120ec43c014050c4ec75b_cobalt-strike_elex_hijackloader_mespinoza_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-23_5d5af33feef120ec43c014050c4ec75b_cobalt-strike_elex_hijackloader_mespinoza_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_5d5af33feef120ec43c014050c4ec75b_cobalt-strike_elex_hijackloader_mespinoza_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads