16d0832b239cd545c45618afbbe4abad14179bf85e0828de2639f1e63c771c69

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b5e8e70415de09a928b0d02061d35cb3_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 12.2MB
Sample260804-l47neshc83
SHA256 16d0832b239cd545c45618afbbe4abad14179bf85e0828de2639f1e63c771c69
MD5 b5e8e70415de09a928b0d02061d35cb3
SHA1 a725f7dc3d149f5d10cfddd9f20d19f6251b3f0d
SHA512 69b238890dbc32b6a0724f99b4cfacd8a5b28d533e696f12710741eb2a6d4925b9e61b231743eb82bee9056ed1ea04d757ba31ec784090defc005214dcbbe2ea
SSDEEP 98304:3piqpiu7pH+4jDdTdqpiwA9zpi57pJdQ7pDpi6A91pH2WpjHrgBFFu416AWvc:tjDdTdMTd8mHpn6F44IAWvc
TLSH
T117D65A5163EA60F8F1BB96359A758331E6727C234931930F13ACD64A1E73650AE39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_b5e8e70415de09a928b0d02061d35cb3_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5e8e70415de09a928b0d02061d35cb3_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b5e8e70415de09a928b0d02061d35cb3_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 18.8MB
SHA256 4e8d8ec666e12259704f42b1ddb6358512e76d7bad674d50d075a0cdfe217cd8
MD5 3f8f708349bffcb65453624f4193eeac
SHA1 1260e605100b6f0f33804d3d5b3ffb2203694876
SHA512 d277df98438e0a9d28fdf47424c73ff908f4b3f1fe14a95a7e9e5b216815a4ddef0383d2784d2bdf29332c452d3c4cdcc4d3072f8a249d267bf2709dcdc42de4
SSDEEP 196608:tjDdTdMTd8mHpn6F44IAWvfzzbqvT5wUWd5SzC:tYOmHN6+JrvfnbG9wUWdKC
TLSH
T193174A5567E991F8E1BBD2348E768731E6727C124A32930F03A8C61E2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4848-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4848-15-0x0000000000400000-0x000000000040E000-memory.dmp