23d0a0ddcfa1a2735073791e23193b8c6a6be99e2722f776388ef62c6855d1eb

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_60e061c9f546a9d3bdbfae4e6b6268cc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 18.5MB
Sample260810-bae17sybqd
SHA256 23d0a0ddcfa1a2735073791e23193b8c6a6be99e2722f776388ef62c6855d1eb
MD5 60e061c9f546a9d3bdbfae4e6b6268cc
SHA1 ddeafa1ac036bfcf3acb83a023611b45bc1b564f
SHA512 60543b16e7773e40b3884c3c1829c135b5c0117a3caafc76ce2b5ab9bdac5c21c2ed10f98615ff73c9cfe9de3f86bc882d52578eb8ca2d3a17f9eaf78e7d5a89
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0bz:tYmHN6+JrXmHN6+Jrvou
TLSH
T175175B5162E660F8E1BB92358A798731E6727C130931934F13BCDA5A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_60e061c9f546a9d3bdbfae4e6b6268cc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_60e061c9f546a9d3bdbfae4e6b6268cc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_60e061c9f546a9d3bdbfae4e6b6268cc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 25.1MB
SHA256 98e4f818bcb3988bda0c6a183ac6ad3982efee9889af6e6f9a3961dea77057d9
MD5 15532e22ca80f8fd61fedbed70ab5cb5
SHA1 5068a796e78fd1a728ce7fb8dba8ce335baa1b00
SHA512 18c0bec0dadfc018f0870410deb9b123166db91b0198698064a9cacb1adf67a407a25d9be8f3c4e2cb929cfee0fac5100aa18e926db9ce4c4cb6da7d1ec2b855
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0b8zzbqvT5wUWd5SzM:tYmHN6+JrXmHN6+JrvotnbG9wUWdKM
TLSH
T1EA475A5566E690FCE0BBD1358A768731E6727C134A32930F03B8DA1A2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1224-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1224-10-0x0000000000400000-0x000000000040E000-memory.dmp