be548e3c08a304c5a7a3cea2507cde0f04412e0ed1788a97b74dd573b06e394e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 22.9MB
Sample260718-bfk5eae18s
SHA256 be548e3c08a304c5a7a3cea2507cde0f04412e0ed1788a97b74dd573b06e394e
MD5 55c2c057fe9c24bdcefe57a7cec9a507
SHA1 99593d18eb884b6e31e2ce8bb23cf65fa9c2b946
SHA512 fcee7dc5c4886d8d2588aba252fbd593b9687a569ded775c34d06d3d1794539086a0cb7388974f27888a09108cd5e7cd4cc764e3e1c553b1f5fba6a30938bd20
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debj+bdTTO:tYmHN6+JrXmHN6+JrvopV
TLSH
T18B375A5172E660F8F1BB96358A798331E6767C134D30934F13ACDA1A2E72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 23.3MB
SHA256 5ab11ba8bd084c800cc0bf785cca388b04d67675243c0bda2b2067ec96802527
MD5 813a28ee79fb1240b1386358027f43a8
SHA1 727c40d762a85a10bf8826493a0f2d0c3d427034
SHA512 7a83ff1301348d76cec8fda89115561a0c5de63adcaeb27ae4fe45e18dc0715a0598f459e91a506ec72dc3cde9bc471b529b9cabfd9423d1fedd9a7261bbc409
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debj+bdTT8:tYmHN6+JrXmHN6+Jrvopl
TLSH
T1B7375A5172E660F8F1BB96358A798331D6767C234D30934F13ACDA1A2E72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4976-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4976-12-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4976-14-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads