Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
26/08/2026, 22:52
General
- Target 2026-08-25_6795740911f05451a35eef1ccbd177e7_amadey_cobalt-strike_elex_hellokitty.exe
- Size 544KB
- Sample260826-2tknxavxes
- SHA256 e46c659f20519030659b63c353b236ec1e65de207a04393844999d54e31dc354
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_6795740911f05451a35eef1ccbd177e7_amadey_cobalt-strike_elex_hellokitty.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_6795740911f05451a35eef1ccbd177e7_amadey_cobalt-strike_elex_hellokitty.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3188-0-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/3188-1-0x00000000750F2000-0x00000000750F3000-memory.dmp
memory/3188-2-0x0000000005430000-0x00000000054A2000-memory.dmp
memory/3188-3-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-5-0x0000000003120000-0x0000000003138000-memory.dmp
memory/3188-4-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-6-0x0000000005600000-0x000000000562A000-memory.dmp
memory/3188-7-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-8-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-9-0x00000000058A0000-0x0000000005906000-memory.dmp
memory/3188-12-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/3188-13-0x0000000006AA0000-0x0000000006B32000-memory.dmp
memory/3188-14-0x0000000007100000-0x00000000076BA000-memory.dmp
memory/3188-15-0x00000000750F2000-0x00000000750F3000-memory.dmp
memory/3188-16-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-17-0x00000000078C0000-0x0000000007992000-memory.dmp
memory/3188-18-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-19-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-24-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-46-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-61-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-59-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-75-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-92-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-117-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-136-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-143-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-141-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-139-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-137-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-133-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-131-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-129-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-128-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-126-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-124-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-121-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-119-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-115-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-113-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-112-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-109-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-108-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-105-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-103-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-102-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-99-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-97-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-1057-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-95-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-93-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-89-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-87-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-86-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-83-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-81-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-80-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-78-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-73-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-71-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-69-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-67-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-65-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-63-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-57-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-56-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-53-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-51-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-49-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-48-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-39-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-44-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-42-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-37-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-35-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-34-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-32-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-30-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-27-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-26-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-21-0x00000000078C0000-0x000000000798D000-memory.dmp
memory/3188-3122-0x00000000750E0000-0x000000007589C000-memory.dmp
memory/3188-3121-0x0000000007A00000-0x0000000007A0A000-memory.dmp