77d219055ad3d9177a0da8f0e66fbc619bf2d45f78a9d28a54585a875bd3f67a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_f407c49d80e23cb5dd54a8c704b34116_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 20.1MB
Sample260730-3b4jqsstdv
SHA256 77d219055ad3d9177a0da8f0e66fbc619bf2d45f78a9d28a54585a875bd3f67a
MD5 f407c49d80e23cb5dd54a8c704b34116
SHA1 2d0c7fe9a923df8188af475aeef991e2e4477e67
SHA512 1867fb8620aa7f79f4bc2c9ffa2db04d88c96d93ca374a5dbc2ad1512db59188e3d511b4c8d1226c949408520f800864fdb3b06f5b31b3bccacce2431e827cd2
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0p6dpJ:tYmHN6+JrXmHN6+Jrvol
TLSH
T118275A5162E660F8F1BB96358A798731E6727C134931934F13ACDA0A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_f407c49d80e23cb5dd54a8c704b34116_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_f407c49d80e23cb5dd54a8c704b34116_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f407c49d80e23cb5dd54a8c704b34116_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 20.5MB
SHA256 2902fbe5bacf360daa17f6c4956f142dfe4ad3d52beed4a4eda0d81ab161b43f
MD5 77c735f4db9fa004921c733036231aab
SHA1 a126d70ecf132ff31a302e4032121d4ea5a6cf2d
SHA512 06e2d048eadca24d75e72f59e560de9c41bb540be6cd4dac51ae4e33a1305b1eaa063ee91960a1f7907ad3f5ffc66de2a947ea14ba2f8603064330a3d6af0aae
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0p6dpp:tYmHN6+JrXmHN6+JrvoN
TLSH
T190276B5162E660F8F1BB96358A798331E6767C134931934F13ACDA0A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4468-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4468-11-0x0000000000400000-0x000000000040E000-memory.dmp