508ac76bc3dffd08b20b5223282a34e5094ff6fa395e633561700bb56af9fe21

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 30.1MB
Sample260819-ecckmswcpa
SHA256 508ac76bc3dffd08b20b5223282a34e5094ff6fa395e633561700bb56af9fe21
MD5 f5fae40145fa20cab17ae39c4b54f19a
SHA1 792b0bd72d992c7598f909880823b9186fca337e
SHA512 9220ef3e6496e8a2c795881708bc2bd26a649de62276db8c7e15f12eff6470108337a92114db4d304ad329903163de8e69f00579059f3f579de56aaa7a81cfce
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0pudlmHpn6F44IAWvjd+jCjsdO:tYmHN6+JrXmHN6+JrvotmHN6+JrvcuR
TLSH
T12E676B5162E660F8E1BB96358A758731E6727C134931934F13BCDA0A2F73650AE39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 30.5MB
SHA256 25bcf08289b4ceeb8bfbb0431645632bb4e0a84b429e637a227296059050ca11
MD5 4e0d821ad84f81117229aceee5ddc006
SHA1 6f2ca0fbb89de15fc94887670928f698596498e0
SHA512 681361f97afb57888b27760c5c8e2392e8dc207b73b551d7b217ed78148a9f3fc6a824e28a4285979ce7f2c6f03ff516142a07ca0b129aeb9326e3723eca5289
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0pudlmHpn6F44IAWvjd+jCjsd0:tYmHN6+JrXmHN6+JrvotmHN6+Jrvcup
TLSH
T1D9675A5162E660F8E1BB96358A758731E6727C134931934F13BCDA0A2F73650AE39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4584-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4584-11-0x0000000000400000-0x000000000040E000-memory.dmp