d8b2230c0cbc6bed388196ee8aaacd9e08dc8b2873d481d8e1032acfc04670de

Analysis

max time kernel
149s
max time network
101s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_e364c40caa8beee09c1b368e258b93f6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 2.2MB
Sample260531-twvmwscw31
SHA256 d8b2230c0cbc6bed388196ee8aaacd9e08dc8b2873d481d8e1032acfc04670de
MD5 e364c40caa8beee09c1b368e258b93f6
SHA1 b4034591fa37d89d4ac77f5ce940ce66b1bcc3da
SHA512 771f4d23a85dcdbd6684c49f0686c4f28ecd3240bce2b1bae1227be05fc68f4820b2c8cd35a743713068435a848d8db83775348cf07aaf86b1fbf8ff18ebc15b
SSDEEP 49152:r+V18P9zWmT2ljEk1qOoCIabjKoh9WKiw2khOH:r+8PwJIabjKoh9WS6
TLSH
T15EA53B0163E85950E5BB16B56EB583025C76BCA00B31C7DFA390BB7D5E33BD06AB1B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_e364c40caa8beee09c1b368e258b93f6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-31_e364c40caa8beee09c1b368e258b93f6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_e364c40caa8beee09c1b368e258b93f6_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads