57d08d3260f0d3e89b8eb20dbf9abf15a3f4dce1b4cdf9ea3d14b08d99b8e9ee

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_0b8faaa5c2979e7ef464232c3e993a63_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 36.9MB
Sample260718-bmhmvsbw2q
SHA256 57d08d3260f0d3e89b8eb20dbf9abf15a3f4dce1b4cdf9ea3d14b08d99b8e9ee
MD5 0b8faaa5c2979e7ef464232c3e993a63
SHA1 1c34d8fdef592da76c0e3f4d9ce4c3c01d84ae1a
SHA512 9ef26b0dbfac35b349c2ca31248eb53058213b1f2ee591724bdf4bb09105256c3b29a2c58a989bba09b47cedf3227efded09ea52f4395869d2e23938a5a53746
SSDEEP 393216:tYmHN6+JrvXWmHN6+Jrv8KmHN6+JrvJBmHN6+JrvK:/br7br4brSbrS
TLSH
T1D8875A5162E760FCE1BB96358A768331E6727C134931934F13BCD64A2E73650AE29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_0b8faaa5c2979e7ef464232c3e993a63_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0b8faaa5c2979e7ef464232c3e993a63_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0b8faaa5c2979e7ef464232c3e993a63_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 43.5MB
SHA256 f3ec96722666854c6154e8ee59fd15ffe1677b9703ee9783237e5cd3f484ad44
MD5 f5e58468e2124a19c3b2fe9a42bf406b
SHA1 58bf56eb0f130bda0ad84aa8ee7f3bbf7597b8c4
SHA512 fbc215f9f4b3b72c290452275f3a42cc97bf294d20057b661f7a8d8a65bfc1886d6b488b886433a35e473b876e80baec3eff0b9e347295ccc74528a41051bdd2
SSDEEP 393216:tYmHN6+JrvXWmHN6+Jrv8KmHN6+JrvJBmHN6+JrvhnbG9wUWdKJ:/br7br4brSbrh0w6
TLSH
T1A3A7495162EA61FCE0BBD2358A768331E6727C134931934F13BCD61A2E73A54AD29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6600-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/6600-8-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/6600-20-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads