0deac223c50db25073b5a510e173f440d84e208df8001b2e50d3594722ee8874

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_4515d4b613df043530bcfd204a095332_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
Size 1.1MB
Sample260529-vdlspsb16q
SHA256 0deac223c50db25073b5a510e173f440d84e208df8001b2e50d3594722ee8874
MD5 4515d4b613df043530bcfd204a095332
SHA1 367057b2b059cd633a1c1323b4a2dc052f2962ab
SHA512 88683b6e1cebb572ec386393f382961e8dac5d84d5c45c8c5722d39b8372b796ffe4fecddb65896664c44b1d0a16a000f8efe58fadd5d0702dcf9e574be3e156
SSDEEP 24576:9FHDUT22CGD5TvinrmpLnQcvhbpQhVMChTo:9Vs356r8KlhTo
TLSH
T1A0355B45F2A04FE1D6AF4134CC618665E637BD954F208BDF2294BF6A3E336909E29313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_4515d4b613df043530bcfd204a095332_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-29_4515d4b613df043530bcfd204a095332_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_4515d4b613df043530bcfd204a095332_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_smoke-loader_stop_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads