03542c189b6a3e796f3a28a2becc716fc8f546de8e838b1a249d20232dd1cd9b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe
Size 767KB
Sample260525-tplfmsf131
SHA256 03542c189b6a3e796f3a28a2becc716fc8f546de8e838b1a249d20232dd1cd9b
MD5 7fd71627e771611fedf5b0e32210b90b
SHA1 fc3059e410a6f868ad17e5ef5a40d6df66d9ec24
SHA512 4ae749a663f3a0f6b615f816cf93b33b98a1fa29bffae32738046463279e9d6b6d78b2153a6fb81f50e4c88ce0ff536c59d6852db1c4edd81ddbbd44e4b5f394
SSDEEP 12288:HKqWkISmpV6HC1GMTzjKMCsEGDfo8ydyFXIyw4G7HBa+sMgVNreout3Ou3Htca:qmIZpV6i1FjQsES2yrwj0YGeTegN/
TLSH
T1B0F48D2139E1A035D17296B15AA8E63565BABF701F3286CB73C4671D1EB0CC19B38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1644	2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SIA_Starter.log

Path C:\ProgramData\Siemens\Automation\Logfiles\Setup\SIA_Starter.log
Size 1KB
SHA256 817e8aea3dc0f05650ddbdf4e08e2b381d45c97047fda1908b7a4ce99bba2e71
MD5 e35277ce89ef29e1c0a599a1f4f867ac
SHA1 b4ad3f2b725eec8d5b8024476e4102999faeab08
SHA512 6d5f86dd128c86d32bedb7f9fd3cc2521b921ce236b520499ff9ff03219cadde6a5944db684d4a9bd6e825999bc6362a4cb1028bfade9a420defec71df38ad3e
TLSH
T13C41D0C20392F2579770665387317AA26C50C3DDCA431236BA5E5D7F134F86247B928C
MD5 SHA1 SHA512 TLSH

Submit Download

SIA_Starter.log

Path C:\ProgramData\Siemens\Automation\Logfiles\Setup\SIA_Starter.log
Size 3KB
SHA256 8dbe2f5aa4b75e4acfbdb28a3c61155f002746ec1bb094fd2b335db087a7b3e9
MD5 0a1dc27406264279eb30daf1b1d658e8
SHA1 3ab1fd2407c81e2d541807a8cb438dcdffadb9f1
SHA512 403e5b37ebebfcee2122c181ed5d63815b1010c5dbe7a48a7183cd3fc657ae6eeb43c7c40ffdf1dd88887cdda8a60d9bb686eefa0e990ba54c30cfd9c0c38360
TLSH
T1706125D28787E62ADA7015434720F9A21C13D7ECCA52217ABE5D0ABF034743697BC5CE
MD5 SHA1 SHA512 TLSH

Submit Download

SIA_Starter.log

Path C:\ProgramData\Siemens\Automation\Logfiles\Setup\SIA_Starter.log
Size 684B
SHA256 82a0f2092c5703b855b9201233fd5117aaff17b687590886ce1bf5c139f5298b
MD5 625161689d6ba029abd3dc000457ec0a
SHA1 895190a31928e1c1add7293ebcf00dd082e3dedc
SHA512 6ec1902110de1565924891346e97e3d1aee17b004b61d9482cbfe8324ff1ec7c95052bfc04e376e67202da513dd15d6c3c3ccefda2e137c75ca1ff0dd34e93c7
TLSH
T16A011AC003E3F18347306687CA313AA36D95D3AD84934227395F297F030FA610B6850C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads