a930615647fb1bd2b0d6acddaa93461836f451703d6cad133a85fee75753b1a6

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_7a0def87aba27f16d464d3c16070d286_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 18.4MB
Sample260709-cjs5vsbx4p
SHA256 a930615647fb1bd2b0d6acddaa93461836f451703d6cad133a85fee75753b1a6
MD5 7a0def87aba27f16d464d3c16070d286
SHA1 71b0684fca7b08eb5bee8c1fec58b2dc5e36b9d8
SHA512 b308c061721670a145a50ae4f17b563debd669e5137b05f4f07e475b1ebf5d705d76ea0dc8adadfd62532e9ac8874b55e39dd05f19d87fec37d3927b38c77923
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvndojGdRqj0d2:tYmHN6+JrXmHN6+Jrv2Bl
TLSH
T1CA175A5162E660F8E1BF92358A768731E6727C130931934F13BCDA5A2F73650AD29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_7a0def87aba27f16d464d3c16070d286_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_7a0def87aba27f16d464d3c16070d286_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_7a0def87aba27f16d464d3c16070d286_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 18.9MB
SHA256 60d2fdc9dc8cad06c79194b3ce164d13bc76bd03dcd6484b3519ad9ff3a3c819
MD5 896a9cf9a81d0ebda4eb75b7eeafbfd1
SHA1 e9491920a97cfb383e5744f32e911d4ff1135eda
SHA512 15295545487cd1e2f1566364105a2391a7c4c0fc0e35d43d45ed7f16a6a906de090bc9344b49c2830f1b5b4e8b7a2de4c88e0a09e98a71722e588ab0000c2941
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvndojGdRqj0dC:tYmHN6+JrXmHN6+Jrv2Bn
TLSH
T1D4175A5162E660F8E1BF92358A758731E6B27C130931934F13BCDA5A2F73650AD29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4896-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4896-11-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4896-12-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4896-20-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads