a9bd33bced648991e3f0d7c408a76f7e87206eb62c0b4b8fb31bb8b6b415d657

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e444f2c4077d032a2f306532864891eb_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Size 572KB
Sample260805-yyfc7sfl7s
SHA256 a9bd33bced648991e3f0d7c408a76f7e87206eb62c0b4b8fb31bb8b6b415d657
MD5 e444f2c4077d032a2f306532864891eb
SHA1 e68116cfaaeb27067f19aaa7a2f955777f05f632
SHA512 ac0904ae2cbd67944d30283240e328a2513a3cdd809a152749532171294680e38d286a631e6a4f87cf1425b58fda7d600499b70f373dffd434b94493bcf5b54c
SSDEEP 6144:t6LT6OYdZFo/Dj9lEYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1ltzqtl:0LTF9jvEZ3CmW9lsq+eYz7QOAku
TLSH
T1EFC42A46BBC1C482F67413B1D44B44F46157AD88E6B26367F2867F8BB8B13D1481FACA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5792	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e444f2c4077d032a2f306532864891eb_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4444	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 5792	880	2026-08-05_e444f2c4077d032a2f306532864891eb_amadey_cobalt-strike_darkgate_elex_hellokitty.exe	89
PID 5792 wrote to memory of 4444	5792	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e444f2c4077d032a2f306532864891eb_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e444f2c4077d032a2f306532864891eb_amadey_cobalt-strike_darkgate_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 208B
SHA256 fb73cfddd3c33072b9e4ea9ae509ac976d5083e99ab482165dcf2848b32daa3a
MD5 96ae07579c9a706430ebb0e0e8c181f6
SHA1 939d766e7664086cbff5484012fbfb214bd9fb06
SHA512 8b80be0b6f0e3391402aa10a880da7dd82a7c54a581c97f9bdaaf1ccc2bb607bc187ece6d2c01ce5103ff7ed5ee21c5404144df267d3e534d57aac2987f12d37
TLSH
T172D0235186AFD3E504C9B00F03F558CDD0B118CF2F492F005380851C01D541DB08B687
MD5 SHA1 SHA512 TLSH

Submit Download