7d9963cdbdfaefdc66373c1c4fec046fc661591f5b046da59d171f0862ba78bd

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_66485eff8025b0f99c18f61c0f8c7bc4_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
Size 834KB
Sample260804-hsld9syvct
SHA256 7d9963cdbdfaefdc66373c1c4fec046fc661591f5b046da59d171f0862ba78bd
MD5 66485eff8025b0f99c18f61c0f8c7bc4
SHA1 5e2f8406c7b13e69ac1dd889a105b5a34c8c1eef
SHA512 f3327948cda6e5197bcc5ab513488c583e587b9f20b07ede84e257d9fa86c4f67045a811fcf47a35bebc1cc2fe69fa8bb682f19bd79a10a672d4e8be413e87b3
SSDEEP 12288:WBhA3SfDkVs+k3mI62ATai/QqzlFCl7yZVrLnJtZsbTTeIhcUqeLYqDRY:giifDk0/AT71Cl7UpsX2Uqoll
TLSH
T19F059E02B6D18471F192017A0A3BF77E6E3DB1105B25C9C7C3E4D99859622E2EA3F35E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1312	2704	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_66485eff8025b0f99c18f61c0f8c7bc4_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_66485eff8025b0f99c18f61c0f8c7bc4_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_66485eff8025b0f99c18f61c0f8c7bc4_amadey_cobalt-strike_darkgate_elex_glassworm_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 356
  2⤵
  - Program crash
  PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2704 -ip 2704
1⤵
PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x0000000000400000-0x00000000004D7C08-memory.dmp

Download

memory/2704-1-0x0000000000400000-0x00000000004D7C08-memory.dmp