be548e3c08a304c5a7a3cea2507cde0f04412e0ed1788a97b74dd573b06e394e

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 22.9MB
Sample260718-bfk5eae18s
SHA256 be548e3c08a304c5a7a3cea2507cde0f04412e0ed1788a97b74dd573b06e394e
MD5 55c2c057fe9c24bdcefe57a7cec9a507
SHA1 99593d18eb884b6e31e2ce8bb23cf65fa9c2b946
SHA512 fcee7dc5c4886d8d2588aba252fbd593b9687a569ded775c34d06d3d1794539086a0cb7388974f27888a09108cd5e7cd4cc764e3e1c553b1f5fba6a30938bd20
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debj+bdTTO:tYmHN6+JrXmHN6+JrvopV
TLSH
T18B375A5172E660F8F1BB96358A798331E6767C134D30934F13ACDA1A2E72650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_55c2c057fe9c24bdcefe57a7cec9a507_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 29.5MB
SHA256 3680a0fdd2155a869df9dc35066f2257f8d5b95d68c8963b5d2ddbb8a899c673
MD5 c0b9b6199ba3aebd474a736b5d56c492
SHA1 001ab3d635018b5e928cc7c382ea1bbfed1c14ae
SHA512 650e7fbf9c8ecae0d218723f75de439cd790666aee9e2125555d09f098d95e7f89a9c6326a49dba24a90f0504adac563cf28198107f0c9e06f6c03f3bc907de7
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2ZdS1debj+bdTTNzzbqvT5wUWd5SI:tYmHN6+JrXmHN6+JrvopinbG9wUWdKM
TLSH
T168675A1163E690F8E1BB92358A768731E6767C124E31934F13A8DA1E2F73A509D39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4228-9-0x0000000000400000-0x000000000040E000-memory.dmp