d8eb77a321074ba0edc13666aacbb19fa9b0748a5c170dc2bacf5e515d59e51b

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_b0d9e3907c1ad2685d28f46c50c91bcc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 16.5MB
Sample260820-3jtpha1tfw
SHA256 d8eb77a321074ba0edc13666aacbb19fa9b0748a5c170dc2bacf5e515d59e51b
MD5 b0d9e3907c1ad2685d28f46c50c91bcc
SHA1 84c93ee8be69043428af189dbb875ee9e89e9d4d
SHA512 c6a5c19c320c1d5a907e68f9e05c9973c29456f5add4ddf3fb73c254efb6b6c4bb060f52a0920a9656d50af5e77e0aad16e056a9d388cca495f993fe3dbcc589
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvkdKj2Adq:tYmHN6+JrXmHN6+Jrvj4
TLSH
T17907395162E660F8E1BF91358A358732E6B27C130931934F13BCDA5A2F73654AD29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_b0d9e3907c1ad2685d28f46c50c91bcc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-20_b0d9e3907c1ad2685d28f46c50c91bcc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_b0d9e3907c1ad2685d28f46c50c91bcc_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 23.1MB
SHA256 9ac8be147f8c2c2ef6906f81f9d5a2cb9c7a1d205f85bca140b206b394085d22
MD5 e2419bc42276e899ad5387cc65a0fbfe
SHA1 0756d494340b3221d1b25896225974b2e1d35f6b
SHA512 95f650e8d6e1755eeb285cac4f8df2880624c037ee88059ee4b1a43e40167b502207bba8416c8401af3e0261bb54716f2e23db77acdc7c81b4c1c39d1c909071
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvkdKj2AdBzzbqvT5wUWd5Szf:tYmHN6+JrXmHN6+JrvjjnbG9wUWdKf
TLSH
T167374A5566E690FCE0BFD1358A368732E6727C134932934B03B8DA1A2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1244-9-0x0000000000400000-0x000000000040E000-memory.dmp