17d586f9035b98a28b7288520f6ab505c7cd7d2b97f21a9db0d401522d54c946

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_ef5bce744c2abec8796fec21ab40af50_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Size 440KB
Sample260602-d775csev4j
SHA256 17d586f9035b98a28b7288520f6ab505c7cd7d2b97f21a9db0d401522d54c946
MD5 ef5bce744c2abec8796fec21ab40af50
SHA1 ddbe874989338d97d9f7e67ae29a40802bd4b719
SHA512 6dc0b926a01bc7a2f9bfcd71e1f2a60dc42c8144c4a6f8cb8040bd8c23025daa012b97232e656c1a56721637941670f765374a8b07f79a2d62c447e9d154f445
SSDEEP 6144:dN2pkbnH7MuaW2q2qaghYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1lti:2pkbi5qjhZ3CmW9lsq+eY+i5LW
TLSH
T1C1A45B1177C2C4A7E9691470CC9AC1F40659FC6CDB6156AFB1823F2E7AF23D1192BA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_ef5bce744c2abec8796fec21ab40af50_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4776	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 1768	5648	2026-06-02_ef5bce744c2abec8796fec21ab40af50_amadey_cobalt-strike_darkgate_elex_hellokitty.exe	80
PID 1768 wrote to memory of 4776	1768	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-02_ef5bce744c2abec8796fec21ab40af50_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_ef5bce744c2abec8796fec21ab40af50_amadey_cobalt-strike_darkgate_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 208B
SHA256 9332d315dfdd194be2b260f9f952aaa7d610ee9446add30904a97ab7ef2f2ca5
MD5 00eb239bdfee83251d25d4b6709f3e59
SHA1 4a243c3f817f5cc1cf02cb77c5964eda418f6203
SHA512 4954a4d80057ed576484abeaa9bd431390cf6949b4644a2d6f00a94f7c001a3ca461dabf05a438bf8cfa4de0ffbb6322909c0480eb57bd82c3d1248388abb560
TLSH
T111D02371A56FD39810C4740343FB2C9DD45514CB3F153B401390D05C509445DB5C33C2
MD5 SHA1 SHA512 TLSH

Submit Download