0d9f716171f8eeaf271c1fd1467d6017943cd4597276318980a8fa74fed3a49b

Analysis

max time kernel
149s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Size 506KB
Sample260701-e5qyqset4q
SHA256 0d9f716171f8eeaf271c1fd1467d6017943cd4597276318980a8fa74fed3a49b
MD5 6a4501e1172d742fafc28d50c6d8788b
SHA1 08caf5a4c94c9062f4f5f93cc8dccf6ef8141ee9
SHA512 9968f69f60c6f7fd43d5e011298d812bb2bbaf15f5acb3ca1207bf695248bded1095c937eaa4d035dca93be3406f40440f1054adb578e6a1e7947e8a765c8fbf
SSDEEP 6144:dN2pkbnH7MuaW2q2qaghYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1lt/:2pkbi5qjhZ3CmW9lsq+eYAUMc
TLSH
T139B44B02B7C1C492FAB50271C48A80F45157FC98D6B167ABB2853F9BB9F13D1582FAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4024	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1988	3800	2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe	92
PID 1988 wrote to memory of 4024	1988	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6a4501e1172d742fafc28d50c6d8788b_amadey_cobalt-strike_darkgate_elex_hellokitty.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 208B
SHA256 fae8f5f572eac0e862e03485908ac5a7fc33802e911ad3d82efd28030a2a6bc3
MD5 4b71f3ec95642d9bad22e75a24424a29
SHA1 2c298fd8a824eeb390971abec8b1a49cdad6f699
SHA512 b22d5bf3f06a511c2df9e4ff42f7c21a178937b633c583f4356685d6b2c06d76c61b051e8faabecf5566420e439bd7b0fe240dbeb29ce20f8ae7679c0cac20b8
TLSH
T173D02334417DDF9510D4701307FB38CDC41015CEAF166B001390841D01D5D5D75D3783
MD5 SHA1 SHA512 TLSH

Submit Download