ad606c37462a9b72fdbeb5b5d80c472b5b80081c6f15696a59ce82bf552ae8da

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_d5387f0fa8b2a97d07cc0af6732d408e_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
Size 11.2MB
Sample260703-c1apvae18n
SHA256 ad606c37462a9b72fdbeb5b5d80c472b5b80081c6f15696a59ce82bf552ae8da
MD5 d5387f0fa8b2a97d07cc0af6732d408e
SHA1 81db086fd913ec91f6b82d0d5e48cda369ba950c
SHA512 0664f9ac05c28187ce24c206fcae1eaa5eefb5b19be540d55b344e4a041c87166e233dea2837a412056c554445b44a8ac927658846cc2b287afd1f4ca4e615b6
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA91pH2WpjHrgBFFu416AWqpi7pisA9kdM7pQpiV+4jv:tjDdTdMmHpn6F44IAWXNdYjv
TLSH
T1A4C65B5163EA50F8E1BB96358A358731E6B67C134D30934F13ACDA1A2F72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_d5387f0fa8b2a97d07cc0af6732d408e_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-03_d5387f0fa8b2a97d07cc0af6732d408e_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_d5387f0fa8b2a97d07cc0af6732d408e_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 11.6MB
SHA256 bccef9cd3a496d957c0ca9ffff74ccc464fc3094bdf82ce0b053815415e8ffbf
MD5 bc73c9cc22ef8c03abded25cf7ab868b
SHA1 6e5a40fb2cfc902c120b5d0e856177c41bd4ed7a
SHA512 21b8b8294f1515bf6303516b36f6fd210b7c71efda7e9a00121398adb5d648e46671d8f2c3a857d885f4a8500b7fa4e025c1dbfda7e96264597d19478d245f08
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA91pH2WpjHrgBFFu416AWqpi7pisA9kdM7pQpiV+4j5:tjDdTdMmHpn6F44IAWXNdYj5
TLSH
T1F9C64A5163EA50F8E1BB96358A758731E6B67C134D30934F13ACDA0A2F72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4176-12-0x0000000000400000-0x000000000040E000-memory.dmp