25f5bf135dd31e960b39ef8b1b1555b3680622cc6a6ae4d6359d2d13ca2c7480

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 15:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_595c01a1413ade7e6e66ad74826b9860_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Size 475KB
Sample260629-tabmwsax4p
SHA256 25f5bf135dd31e960b39ef8b1b1555b3680622cc6a6ae4d6359d2d13ca2c7480
MD5 595c01a1413ade7e6e66ad74826b9860
SHA1 8ba9768d717d158525dfbb5a2051c435f165f18e
SHA512 76a0c3e39fd34c0fb004157a2c872cf3a3362fbfe5a31438bd948cb24668473c90e6755eb6ae1d6fff004ba2d518d2623e1209a54293ea4e42e95c35dfa17d12
SSDEEP 6144:t6LT6OYdZFo/Dj9lEYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1ltzqtO:0LTF9jvEZ3CmW9lsq+eYzJ
TLSH
T149A43902B7C5C497F9781570C88681F0115BFC68E7B162ABB1967F5B79F13E1082FA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_595c01a1413ade7e6e66ad74826b9860_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2372	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 3240	1372	2026-06-26_595c01a1413ade7e6e66ad74826b9860_amadey_cobalt-strike_darkgate_elex_hellokitty.exe	87
PID 3240 wrote to memory of 2372	3240	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-26_595c01a1413ade7e6e66ad74826b9860_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_595c01a1413ade7e6e66ad74826b9860_amadey_cobalt-strike_darkgate_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 208B
SHA256 14fcd401b13384f1b044dfd60d5c562d94bfcdd195b5677b8a3eff1ec4935fc3
MD5 b23145e9071fc0717dc312581b932d2c
SHA1 8cdbbd15fb0847262d9451fdaa5c59d241ca88da
SHA512 013778b14624502820299041e028b25ab6253e826fd3e688ead582d8e3d7f8c3e13f6b8ca1e795170242b3c377742a2948d0c975c6a111bbcc7b9db80ea57d7d
TLSH
T18ED0A750957AD7950488B4034AF61C9DC05015CB2B552B001380C55C109A41DB2C6686
MD5 SHA1 SHA512 TLSH

Submit Download