03542c189b6a3e796f3a28a2becc716fc8f546de8e838b1a249d20232dd1cd9b

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe
Size 767KB
Sample260525-tplfmsf131
SHA256 03542c189b6a3e796f3a28a2becc716fc8f546de8e838b1a249d20232dd1cd9b
MD5 7fd71627e771611fedf5b0e32210b90b
SHA1 fc3059e410a6f868ad17e5ef5a40d6df66d9ec24
SHA512 4ae749a663f3a0f6b615f816cf93b33b98a1fa29bffae32738046463279e9d6b6d78b2153a6fb81f50e4c88ce0ff536c59d6852db1c4edd81ddbbd44e4b5f394
SSDEEP 12288:HKqWkISmpV6HC1GMTzjKMCsEGDfo8ydyFXIyw4G7HBa+sMgVNreout3Ou3Htca:qmIZpV6i1FjQsES2yrwj0YGeTegN/
TLSH
T1B0F48D2139E1A035D17296B15AA8E63565BABF701F3286CB73C4671D1EB0CC19B38F36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7fd71627e771611fedf5b0e32210b90b_amadey_cobalt-strike_elex_hijackloader_icedid_luca-stealer_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SIA_Starter.log

Path C:\ProgramData\Siemens\Automation\Logfiles\Setup\SIA_Starter.log
Size 3KB
SHA256 8817b2ffe5e03308076f6e3304d5767efc07616cdd86b8deb2ebfb1b947b18a8
MD5 6045b2b1b412321197e7ce58e69553c1
SHA1 bbddae5ddd8df2e57a036251785f2001de431ed2
SHA512 f3552c10b4ea53ca727399c182e14953e288c9dbcdc1b3530663ed70fb84c9369f7f109393e2b0254d4b9b024cd90e0e289d0673fbdb7808935c678ea0ff781c
TLSH
T1FF6112D28B87C62AAA7019834730F9801D52D7ECCA52217FFE5D02AF030743697AE5CB
MD5 SHA1 SHA512 TLSH

Submit Download