Overview

overview

4

Static

static

3

2026-07-28...te.exe

windows10-2004-x64

4

2026-07-28...te.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 22:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_a66d753b09ded516a026dfd73984f945_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
  • Size 8.5MB
  • Sample260728-2aecsaaq8v
  • SHA256 3711477f5dbde158a7f9b654f69f44480f7166b8668950dc4c7e74ae784170a5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_a66d753b09ded516a026dfd73984f945_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_a66d753b09ded516a026dfd73984f945_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:3404
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4348

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          appvcleaner.exe
          • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
          • Size 10.6MB
          • SHA256 9934c2dddc39b0129e77e104d8b91d1bd8d94580f1052e400c293db5abb6a121
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 947B
          • SHA256 ff436d7943740eacdf7c4b8fedc8a1411b3d4fd6854ea715ad11e4da3df08465
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 1KB
          • SHA256 acc89219ad0556da8e97a403015a6171c98d495503d6a3caefba3165f744cd20
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 1KB
          • SHA256 b707ff60cd3ca9b1c0ef1e3fedeef8f413ed3e0cfeb647303b74237b015c84c5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 2KB
          • SHA256 df1ee1ba8fff116aef478ee8b6f179815e5b0b363b535566ecf3639274a60cee
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 3KB
          • SHA256 d361cd82b7bd38531a480c904a349a1a910dccf4c7642fa57565bca9d4f931d1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 230B
          • SHA256 14542630f2a546ca38c0fa7bc1458aa6d64f7bd1870bc2611d703c901df55842
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 3KB
          • SHA256 c8b56407bfd92aa3826d8f28303067d71e3ad3698b9e11e0f3c4af2fe0a6d4cb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 3KB
          • SHA256 bffdc3d69c6d3fa2dea87bed6a8c8da63551645e1e4bb56885dad13e4635030d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 3KB
          • SHA256 36e7c0aa8bb4f6c0aab3ac715e7aac861a500ff068c987725573c12068758fe9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 3KB
          • SHA256 56c23358c9df8d7aa4657f95d0177fdba2fbfbf33da3a686d2fb140b1be9e88b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 4KB
          • SHA256 cbffe3614e64eae978fb9b235d0e4e3fa25278e1972a6be7443b2bcec66b6261
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 4KB
          • SHA256 11dd5fa4d5f61ab788c2f44ff8f22762f74136e67fbe1fce1a1fa7abeb98254c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 518B
          • SHA256 9b259546420f9210d0e75bab7815b8e5aeb47f778a1b2cc61b23f33d8b849c9b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 60B
          • SHA256 668363022751a15c50d60ce343daae2897701894d4bc0043f521de54731e3146
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 576B
          • SHA256 e1ea810a7d8fb65c9e93312cb8858d1ab224911358231321e0a7d3801ae23b4e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 748B
          • SHA256 6348c0fd32a67393b920add3df4faf54b652e5087f185daeb9cff01e7c725694
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 840B
          • SHA256 5dedf5a036202d84fa0df0ea3dda04354f455b1c9ae4b9013585a28863496f4d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          log.txt
          • Path C:\log.txt
          • Size 877B
          • SHA256 195fce03fd4cd2c078e203d0743a214ab4608ac543f2c1e9c406734217a6a180
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3404-3344-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-6971-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-2033-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-4996-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-5421-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-5582-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-6159-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-2037-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-7776-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-8457-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-8458-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-10644-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-11328-0x0000000000400000-0x000000000040F000-memory.dmp
          Download

          memory/3404-11445-0x0000000000400000-0x000000000040F000-memory.dmp
          Download