120ecab56ed2d84a9bd8ffefd0f7c417062d13eb134be2f35e6cd1e2d4000525

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5ea8c69ea3d24d078cac9cdd7c7b3c20_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 19.8MB
Sample260803-c4xzjsbb47
SHA256 120ecab56ed2d84a9bd8ffefd0f7c417062d13eb134be2f35e6cd1e2d4000525
MD5 5ea8c69ea3d24d078cac9cdd7c7b3c20
SHA1 af90c3dca99b6bc1d9b3d9a39f4d7005e7a8dedf
SHA512 8bde43e909af727e9dafe9f717c35edc82165faa86190a081966a7fb53ca7acc3e2731e43d71ab30e39153941b73e67c58208b256f2df1e15013927b67f62298
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpnbKdymHpn6F44IAWvt:tYmHN6+JrXmHNJmHN6+Jrvt
TLSH
T1FB275C5162EA60F8E1BBD2758A358732E6B27C130931934F13BCD65A2F73650AD29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5ea8c69ea3d24d078cac9cdd7c7b3c20_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5ea8c69ea3d24d078cac9cdd7c7b3c20_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5ea8c69ea3d24d078cac9cdd7c7b3c20_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 26.4MB
SHA256 a5472d81e72a19152222b880402de3841915115ba4dda9c829b3e698050f1f20
MD5 6ed9ba48f109ef042bf5f7b3c875d736
SHA1 bfa76597a2cedba9d774e11a22d284ef393e6a09
SHA512 8c22c3108a975af01f7402f2442f8bcd19d59a7eb41dd5ea8beb5c8f6338581cd6c1216cc69a34e166b8eda607942965eebc60453cfeecc0f4ba570ee8b662ae
SSDEEP 393216:tYmHN6+JrXmHNJmHN6+Jrv6nbG9wUWdK2:/brWybrE0w9
TLSH
T174575B5566EA50FCE1BBD1358A368732E6B27C134931930F03B8DA1A2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4976-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4976-10-0x0000000000400000-0x000000000040E000-memory.dmp