97029d9bc50ef087f6a15ca7699e632882106303e920aca6d84247a8583c747e

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_b0c70f55542664603f90c4e8381f1fa9_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 21.2MB
Sample260702-jc985ady8t
SHA256 97029d9bc50ef087f6a15ca7699e632882106303e920aca6d84247a8583c747e
MD5 b0c70f55542664603f90c4e8381f1fa9
SHA1 db6f313dab7f59b90b0ef1fec34ff6638bab1bba
SHA512 71f9ebd2817037b8a63ce1b6f58268ced607cf62b67ebaaffacf8bb469fe67aa741d9462d3e113fa48e2be31802169ca05a5b10c61a378d70aeded4800bb289f
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debjuu:tYmHN6+JrXmHN6+JrvopN
TLSH
T10C275A5172EA60F8F1BB96358A758331E6767C134D31934F13ACDA0A2E72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_b0c70f55542664603f90c4e8381f1fa9_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-02_b0c70f55542664603f90c4e8381f1fa9_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_b0c70f55542664603f90c4e8381f1fa9_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 27.9MB
SHA256 1981fff7f3a8a23fa07ace6857741ca8947f135e89a8c14621d36e62d0f2de32
MD5 6f33fb95bb2e8cd2806b49f4b1451de9
SHA1 3b411fa9397423cff119fa006da2c0d30391f273
SHA512 3ca7a3a8daf54e812f38ed2e2e6a53cfb47334241bd64fe84cf25e495cd0ac23332296312eb1d64f1d453838d497b1336c6a191c6757c783964061fb6d7e9f3b
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debjutzzbqvT5wUWd5SzA:tYmHN6+JrXmHN6+JrvopanbG9wUWdKA
TLSH
T1B3576B5163E690F8E1BB92358E768331E6767C124E31934F13A8DA0E2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6000-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/6000-9-0x0000000000400000-0x000000000040E000-memory.dmp