ab83f2a1a05c0793d6bd8ee108436a8c99f1438d5237d5111525de61654887fb

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_d10f812d43ef892dfa414e3e88743166_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 18.6MB
Sample260601-b99pvsbt4t
SHA256 ab83f2a1a05c0793d6bd8ee108436a8c99f1438d5237d5111525de61654887fb
MD5 d10f812d43ef892dfa414e3e88743166
SHA1 76a41692a168341268c44da9e4531ffd91dfe7e9
SHA512 40b7cf2faf1f9ac6345e26f850350105bcdb9cdbd6026c8c11ffe9948b6270e5464a6d42a1aee7b66a96cb124c5f65f260b7ff8b0c1b8ad7ecb780fff78e8615
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zdwj+:tYmHN6+JrXmHN6+Jrvoma
TLSH
T1EC175A5162EA60F8E1BB96358A358731E6727C134931934F13BCDA4A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_d10f812d43ef892dfa414e3e88743166_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_d10f812d43ef892dfa414e3e88743166_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_d10f812d43ef892dfa414e3e88743166_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 19.1MB
SHA256 9314ef191a16c3da13f5ce2ddee2fe15ebce277f80b8f8dea0c130fb21be23e1
MD5 948dd054b727df30fd172e63824cb3a9
SHA1 a2bf89839a2d00ec53acb7d62fb9c4e1acbb271f
SHA512 f84a6585ccf04c4b29ae51a30e595f9a5c34854864f681bd207a80b3dd2cbdf89cc16806ab6f2d57a40c75eb5266461a94087478610789d5951dedec24c761f8
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdwjC:tYmHN6+JrXmHN6+JrvomW
TLSH
T164175A5162EA60F8E1BB96358A758731E6727C134931934F13BCDA0A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4016-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4016-17-0x0000000000400000-0x000000000040E000-memory.dmp