22ee4a5db9a6e10d12ba59e2fbae56fa4c24f0f1e5ac25e899ae7685322e39de

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 14:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_6ee2df6185536201efb9e26f978e1933_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 875KB
Sample260604-r66f2agy9s
SHA256 22ee4a5db9a6e10d12ba59e2fbae56fa4c24f0f1e5ac25e899ae7685322e39de
MD5 6ee2df6185536201efb9e26f978e1933
SHA1 47b11c1ddaeb4c7e0c6cc3eb38e7ee58f33f272e
SHA512 5f729c6870cfa838a070774135160504551757ca5e3e284f2fb101290c7c205a2bedd1b61d297510d1c33f5595081d9dcb1da388031eb8c062b0c1e4ac1b86a6
SSDEEP 24576:mEo3f3mnXoZ643mnXoZ6i6cMJlCUQ2RojEo3u:83k03kHRJR
TLSH
T1D415AE03EB9400E8D10AC1749AE69A23EB75BC56177097CF2368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_6ee2df6185536201efb9e26f978e1933_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-04_6ee2df6185536201efb9e26f978e1933_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_6ee2df6185536201efb9e26f978e1933_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads