bd34dfcadbf6a8c425e55f5e65b44719783dfd1bd8542029be724422d96ab9e3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_4811f4190ca259ffbef66b9ca3adf301_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 22.9MB
Sample260719-2rfbeahv4w
SHA256 bd34dfcadbf6a8c425e55f5e65b44719783dfd1bd8542029be724422d96ab9e3
MD5 4811f4190ca259ffbef66b9ca3adf301
SHA1 9aee4d807108764e43ced477e0ccb4aecd5f86cc
SHA512 6104ebd3b5fa3a2f85da69a7a8735aaf63f1e1b5169a1a18c261902491222f14d1f485ed9a3deaf7e55bdecbcfa66700fa63d1aa3a55c67fdcec661ce3f04868
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWv1dcCjDdP+dTmHpn6F44IAWvk:tYmHN6+JrXmHN6+Jrv7KmHN6+Jrvk
TLSH
T1EF37396162E760FCE0BFD1758A368732E6727C130931934B12BCDA5A2F636546D29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_4811f4190ca259ffbef66b9ca3adf301_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_4811f4190ca259ffbef66b9ca3adf301_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_4811f4190ca259ffbef66b9ca3adf301_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 29.5MB
SHA256 7900570bb09f9ff67fd95db8bcac2a8dab1277bf353304afb67aa3d708cafb03
MD5 b28b39756bb7bb9faf161b0c8c606724
SHA1 18a93534244030d2dd003e9975d0e68389b771dc
SHA512 bb945532f8dba8b851fbd54db96b3ad62d2dd4124c4b62244f6a84bbb8d14e8a51d4981d544c75ee877b13e5e285636c12f3a8b986c3155da1f28eb63dc8f062
SSDEEP 393216:tYmHN6+JrXmHN6+Jrv7KmHN6+JrvHnbG9wUWdK2:/brWbrLbrj0wR
TLSH
T1AF674A5562E660FCE0BFD1358A368732E6727C134932934B02BCD65A2F73A54AD29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1212-10-0x0000000000400000-0x000000000040E000-memory.dmp