2e20e3e4ff18bb263db6f03856064c09ef7706aa031e2df01c4c1c1e13413fb1

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_de8fadb586eeabc3aba6645326c0ebbd_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Size 685KB
Sample260529-tswqsagy6v
SHA256 2e20e3e4ff18bb263db6f03856064c09ef7706aa031e2df01c4c1c1e13413fb1
MD5 de8fadb586eeabc3aba6645326c0ebbd
SHA1 364248ab0d7f71a47438e9a4054fecbd2ee875e5
SHA512 53f3840232f9907e29360935d5c0b3bac56bd35ac67c229c8e1aea779e6d0e3bd3c892da8c97133e90fae03c79631da7b50efc80ab2c519fb39533348e82d829
SSDEEP 12288:9gsHyMqLHFZlx22CGD3JeU7vinrmlUagw:9FHDUT22CGD5TvinrmlxL
TLSH
T1B7E47B4172D48FA5D6AF4034CC928671E637BD914F214BEF23947F6A7E322D0AE29613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_de8fadb586eeabc3aba6645326c0ebbd_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-29_de8fadb586eeabc3aba6645326c0ebbd_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_de8fadb586eeabc3aba6645326c0ebbd_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads