2946eca1ce016d7ecca80d39cba67c29a5a85eb04b9387614d022c1a431f7e5d

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-26_fdc40eb4f2d3c3436eedffa21ffba567_amadey_cobalt-strike_elex_hellokitty.exe
Size 798KB
Sample260827-ajftesxhrd
SHA256 2946eca1ce016d7ecca80d39cba67c29a5a85eb04b9387614d022c1a431f7e5d
MD5 fdc40eb4f2d3c3436eedffa21ffba567
SHA1 735f4bf1322ea11af10b013a9eaa9d75b4b5b576
SHA512 c71d2e8c97c5a459ca6f3200b2a4ff7c46f8768569cc6b76616005828f727f6141a6c1c4e424cad2e652311f5aeed5889922f8bb36ad2c90081e578db16b88ce
SSDEEP 12288:QcEzV2meV1vM5lx4K2wP2zDB+UwYSou+SAvgW7KNOj4QQWS4fuP03s+mUFTgNX:xW8hW3PBtBoeK7KNOF4h03rFTA
TLSH
T11405232235C29030D9666C3158F5E6308A5FF6345F63AAFB7358235E6E342D0D532AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6096	WINCOMPRESP.exe
1968	WINCOMPRESP.exe
1356	WINCOMPRESP.exe

Loads dropped DLL 3 IoCs

pid	Process
6096	WINCOMPRESP.exe
1968	WINCOMPRESP.exe
1356	WINCOMPRESP.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_fdc40eb4f2d3c3436eedffa21ffba567_amadey_cobalt-strike_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINCOMPRESP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINCOMPRESP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINCOMPRESP.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 6096	3664	2026-08-26_fdc40eb4f2d3c3436eedffa21ffba567_amadey_cobalt-strike_elex_hellokitty.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-26_fdc40eb4f2d3c3436eedffa21ffba567_amadey_cobalt-strike_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-26_fdc40eb4f2d3c3436eedffa21ffba567_amadey_cobalt-strike_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe
  "C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6096

C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe
C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1968

C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe
"C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Edge.dat.LOG1

Path C:\Users\Admin\AppData\Local\Temp\609A0EE3\Edge.dat.LOG1
Size 6KB
SHA256 2f8b8d4fb2f267fb14e60042453fc2e6dc844a0aede2ef47c049901249e20169
MD5 78af57ffb1404e235f229693e95b2c4c
SHA1 5407e7b3786c7f87878f21cee4bbac32fd0f68a9
SHA512 29bed9bc6b0f880452d67a670486fcfd4dfa1a4a1c292ada1209a94ef700e3bdd11606ed80417b9f0a2d5b02dfaaad9cb33f77bb8c22ec533a443b2e48436be4
SSDEEP 96:jP3QLenVvNiuQHXXSINjnoiZdxmmuLJNi0jc9elkukfCvabE8rLITCc/fd0aSR7m:jP3SgvwnrN7Bn0jkeKue4UseeT07m
TLSH
T1D4D1A045D005687014EB5B315F6CA4A7B76889FD58BB2F9012337F8D1646179B233F54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINCOMPRESP.exe

Path C:\Users\Admin\AppData\Local\Temp\609A0EE3\WINCOMPRESP.exe
Size 727KB
SHA256 285d1f375eedb5dc30b2962ed45187f1fe07cfd09de101faca8a1b2416e6bd69
MD5 6560672839761b34d125689c1f7b5a67
SHA1 22a86687563ebc3c49497dee5672bb977ef24e5b
SHA512 342d1b7970ac08fdc2e32561b9e94a17f632acb40067d2a4697ba7b971e9ffa8fd6d92248dc1c307a41975449c4d80b885b2e95fa1fae73e16756c622924a288
SSDEEP 12288:hPIHfuY5dwaOjXgq3Z5LbCS8fRwlGaEn+LaSJ3Kw8+bxAaWUeICV+YEcBpbQD/Mt:hPI2qqHCXfRwlGaEn1AbxdWUrCVyYpE+
TLSH
T14AF49E2135C2C07BD572023049ACEB7A45BFFA300B748ACB63945B2D5E785D25E36B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\609A0EE3\libcurl.dll
Size 298KB
SHA256 3fa921849e0072638c34b5d059b4686eda9314a2fc98cab0a34456286425914b
MD5 fcadb95e18e744e29f299977aaed282e
SHA1 03e52a0a95ac9c0fb2b02c91972509c017613ce6
SHA512 c5475af6b9a156801cd8c41d9a0402f75947d1e141e2785570d4db4a5179983ca670e0b561c1edabe59c9ac3783207caacd636b590fcb2e7253aa87806c92383
SSDEEP 6144:uul6fVa95gpuzsxt2JDmK+X16bAOKYnY9bBedH:uuAa9jJDmxMAYnY91edH
TLSH
T1D054381077F2A4B5F5EEC4301698A6D68618E4B2877A85D773800E6FCF311C195FBB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads