508ac76bc3dffd08b20b5223282a34e5094ff6fa395e633561700bb56af9fe21

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 30.1MB
Sample260819-ecckmswcpa
SHA256 508ac76bc3dffd08b20b5223282a34e5094ff6fa395e633561700bb56af9fe21
MD5 f5fae40145fa20cab17ae39c4b54f19a
SHA1 792b0bd72d992c7598f909880823b9186fca337e
SHA512 9220ef3e6496e8a2c795881708bc2bd26a649de62276db8c7e15f12eff6470108337a92114db4d304ad329903163de8e69f00579059f3f579de56aaa7a81cfce
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0pudlmHpn6F44IAWvjd+jCjsdO:tYmHN6+JrXmHN6+JrvotmHN6+JrvcuR
TLSH
T12E676B5162E660F8E1BB96358A758731E6727C134931934F13BCDA0A2F73650AE39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f5fae40145fa20cab17ae39c4b54f19a_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 36.7MB
SHA256 c3b91eece58f5717a3f820abfd811f2df5151b396391f9847c6ab0c0e242fc74
MD5 223f9f5c80824fadd1dd43ef6a0a3b0a
SHA1 a714b83a73c50c3d91bb20baee3fbe1c3e20b83f
SHA512 b3dfb21bc70479e7e58c164b39805a673472037c90f065e611f9d22afbbc874e29cb175b3af6291111b81a891eb24503fb158270d9bf7e6b5d63daa7dd17fb82
SSDEEP 393216:tYmHN6+JrXmHN6+JrvotmHN6+Jrvcu2nbG9wUWdKE:/brWbrfbrq0wL
TLSH
T1A7875A5162E650F8E0BBD2358A768731E6727C134A31934F13BCDA1A2F73A54AD29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2132-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2132-8-0x0000000000400000-0x000000000040E000-memory.dmp