d69c010d98605bf6bde5befc276a00aeb226ccc789bd9bc3c3ff3d4b5ebfb5e3

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_5c28cf719ce8cbef5439861fd75085c0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 18.6MB
Sample260601-bjnppsds3j
SHA256 d69c010d98605bf6bde5befc276a00aeb226ccc789bd9bc3c3ff3d4b5ebfb5e3
MD5 5c28cf719ce8cbef5439861fd75085c0
SHA1 8d724be2cececf7fa9fc2819c86d68837f3e79ad
SHA512 dd1537ab185eee2d79e21f80daaf9540455b34836eaebf54a96975b64d73d7883aae245d7ba90ced8dec6c91d189ff6ff8f06f6e0605928c4c486147b5af2b39
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zdwj7N:tYmHN6+JrXmHN6+JrvomN
TLSH
T181175A5162E660F8E1BB92358A398731E6727C134931934F13BCDA5A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_5c28cf719ce8cbef5439861fd75085c0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_5c28cf719ce8cbef5439861fd75085c0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_5c28cf719ce8cbef5439861fd75085c0_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 19.0MB
SHA256 a195f0e64c3a26b5ef15ccbaadbb0d29519bcfb441b1b191fec852e12408448f
MD5 e604a49999186f8ce448a01693bb2e37
SHA1 53bbeae7dc74faf7d31d72ccd0f978fa67bb9d2a
SHA512 4b703800d67284a5e9bebb77ed076a54198244160efc1f7ffe0866062f59ac79ad6928e566a6911ef6cd66ad26c82a88a927fc95ba04ae0431d8a8b6a7ab56c1
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zdwj76:tYmHN6+JrXmHN6+Jrvom6
TLSH
T151175A5162EA60F8E1BB96358A358731E6727C134931934F13BCDA1A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3988-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3988-12-0x0000000000400000-0x000000000040E000-memory.dmp