e75caa5c7d840b86797249ac598942d42abc074d2754a140b09e30fd8a860409

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_29e17f2265108d3e8e1ef7763e7b302e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_stealc_vidar_wannacry.exe
Size 7.0MB
Sample261007-eg214ads2n
SHA256 e75caa5c7d840b86797249ac598942d42abc074d2754a140b09e30fd8a860409
MD5 29e17f2265108d3e8e1ef7763e7b302e
SHA1 ccfb469325782c590bdecaced3d7e419ed4fa64e
SHA512 29875466ccf48c606ff2a94986256c743300c7ca26afca5872e7e23997b3a0bd3f721a58e871c98e278ddd04b4d791f601af7052ab45b734201d9b9947da0917
SSDEEP 49152:AtRJpqJtb2IKRJ7mT3S9tsgX8zEC8ULgCSA/Bkj00mIU6iCVwASO5GtlqodL51Gk:2RPRRdmTIOSAk+d8MUSXIYa3Y4zhjo
TLSH
T19B768E26B3E405A6D07AD27DC061053AE7B1782B5B72C7CF2554A9AD1E637C28E3B313
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3616-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3616-1-0x0000000000400000-0x0000000000420000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_29e17f2265108d3e8e1ef7763e7b302e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_stealc_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-05_29e17f2265108d3e8e1ef7763e7b302e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_stealc_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_29e17f2265108d3e8e1ef7763e7b302e_amadey_cobalt-strike_coinminer_elex_glassworm_hijackloader_stealc_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3616-1-0x0000000000400000-0x0000000000420000-memory.dmp