0bfd07fb11656c2bd913fc45704cdd3d52454531d28386cd732af4d95ab48516

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_55edfeacfdec2a94f1d2b6665e3a6682_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Size 495KB
Sample261113-pbd27aa12v
SHA256 0bfd07fb11656c2bd913fc45704cdd3d52454531d28386cd732af4d95ab48516
MD5 55edfeacfdec2a94f1d2b6665e3a6682
SHA1 fe6791eefc9e13f7c9ccae22a1f4019a16ba332a
SHA512 ee79cb1ab5349df034f343cf682b1b9164f62bb2668874f86348f60f693f048b2e13a44d7bd3f4bf002c465f88197136293c9768c532fdd3defb2f57b5259fea
SSDEEP 6144:dN2pkbnH7MuaW2q2qaghYenWS1uH9vd/he9Bm9lsqPm5C/vOTKsMiCKEU5uK1ltb:2pkbi5qjhZ3CmW9lsq+eYuC
TLSH
T1E0B44B12B7C1C492FA741171C88A80F41157FC98D7B157ABB1823F5BB9F23D2582FA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_55edfeacfdec2a94f1d2b6665e3a6682_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
876	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 4144	4948	2026-11-11_55edfeacfdec2a94f1d2b6665e3a6682_amadey_cobalt-strike_darkgate_elex_hellokitty.exe	88
PID 4144 wrote to memory of 876	4144	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-11_55edfeacfdec2a94f1d2b6665e3a6682_amadey_cobalt-strike_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_55edfeacfdec2a94f1d2b6665e3a6682_amadey_cobalt-strike_darkgate_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 208B
SHA256 a5afc6444ff8934def98c459e6f6fbbe05c3ca2dc66577b280cc351dfdd81038
MD5 98d7136233658653470822f9c11322aa
SHA1 adb3e3a5119f957b478f955809f623fb5f8c0818
SHA512 9a3a1c295e8fe6f8e9d0ff883cf4532b07a66040beb6e4370858cd5bd30dd394a795d59d855c6661c7122eb48df1bf3c478f64c668c2302748cbce059de4c606
TLSH
T1EED0A921806EC79514C4B01607FB589ED05418CBAB142B212390C80C11E5C6EA887EC3
MD5 SHA1 SHA512 TLSH

Submit Download