3ddaa895ddd3478a22ab6188c13b3af0ab4ee834471cc05068318ed6f168a9d5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_3ee73853ba9db1fee523fc9af98d00cd_amadey_cobalt-strike_elex_play.exe
Size 143KB
Sample261003-reb34sdf34
SHA256 3ddaa895ddd3478a22ab6188c13b3af0ab4ee834471cc05068318ed6f168a9d5
MD5 3ee73853ba9db1fee523fc9af98d00cd
SHA1 dca8fb68115077da72329487fa09bc8e6af8e0cf
SHA512 32432efce2bbb9003f79aef5df30861a1250cb33c3be1ed345ca5df560a4c9a49ac9bf6631eae99dc94e46db889db6bac2d63c3cb8ba29cb79006192e95744e0
SSDEEP 3072:S92dYDTjjb0kg5IGyxnzv9zoQe4xVEFtnRPF9EVnb43jaI5grI2v0:c9fT0kTzlz49FtnRPF9cCGrI2v
TLSH
T167E3AE12BAD1C075F5B209342C26D6C1CB7E7C815B629DAB3BD8366ACF342C09532E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4220	572	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_3ee73853ba9db1fee523fc9af98d00cd_amadey_cobalt-strike_elex_play.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-02_3ee73853ba9db1fee523fc9af98d00cd_amadey_cobalt-strike_elex_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_3ee73853ba9db1fee523fc9af98d00cd_amadey_cobalt-strike_elex_play.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:572
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 572 -s 356
  2⤵
  - Program crash
  PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 572 -ip 572
1⤵
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-0-0x000000000044F000-0x0000000000450000-memory.dmp

Download