6870688a4934091b850cdb6625687cf7d19d5ddab7177128980a25059c7023d7

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_32adf3af5b454a1d93a2b7b8076cc15d_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
Size 5.6MB
Sample260801-d3yp5ada44
SHA256 6870688a4934091b850cdb6625687cf7d19d5ddab7177128980a25059c7023d7
MD5 32adf3af5b454a1d93a2b7b8076cc15d
SHA1 881361ec5a27177072db3604ee156919e3d8e6da
SHA512 f8b8229cff34ebfdd7fbcd933886a14841b0480ad2c064459ad21cd92bdddae5893a0a71fe2655146463b0c6548c207160cab1208bf8c8bcc59f835e8b68cee8
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA9zpinp78piC+4jQ:tjDdTdMTqjQ
TLSH
T130565A0273E48535F1B75B319E7992719A7BBC218E34C38F2394DA1D2E71690EA35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_32adf3af5b454a1d93a2b7b8076cc15d_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_32adf3af5b454a1d93a2b7b8076cc15d_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_32adf3af5b454a1d93a2b7b8076cc15d_amadey_cobalt-strike_elex_hawkeye_hijackloader_icedid_lu.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 12.3MB
SHA256 3718c5bc38d2b1c3ff172088f800e45d138d8e0fbb4d3de61dad2c53317bd33b
MD5 5788dd4f6b737f1e66a761450240dd89
SHA1 792d1655444727190d3c6bc2deaf15eb2fa8075b
SHA512 325eb35a74d2f91baba635b50ff7492a69837bf28b6ec14950c2c10df5a47cb00f0db76bc1bf11dc84113d791e8d36c01aac7031966ed9af5113f15d73bf9f3f
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA9zpinp78piC+4j7zbnbTWpz1T5mFB1GWdhrrmqJjeY:tjDdTdMTqj7zzbqvT5wUWd5SzY
TLSH
T1B3D64B1567F481F8E1BB92348E768771E6767C518E32974F03A0CA1E2E33A949D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4588-8-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4588-9-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads