3a2602d8cb0cba02bbac286aa12c4b777d230e671de8b61c7ec5a1aa2b6cb43e

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_8f97242c0983e17a514d1dd60f50c542_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 19.7MB
Sample260827-p4gnsavdrh
SHA256 3a2602d8cb0cba02bbac286aa12c4b777d230e671de8b61c7ec5a1aa2b6cb43e
MD5 8f97242c0983e17a514d1dd60f50c542
SHA1 b7d3eb3c3dff6448c974f48d95dd8b05996c8fbd
SHA512 c099d009541056ddd47b8543127786b45a7a0a6c07feebb7409fac887f1c60a60ee7a67eda6505530cbe8534ac497bb6d1b18154d7e955062cbae1f261b0d088
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0bSj0t:tYmHN6+JrXmHN6+JrvorK
TLSH
T144276A5162E660F8E1BB96358A398731E6767C130931934F13BCDA1A2F73650AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_8f97242c0983e17a514d1dd60f50c542_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-27_8f97242c0983e17a514d1dd60f50c542_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_8f97242c0983e17a514d1dd60f50c542_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 26.3MB
SHA256 9e64d8425605c5dec41b17eda4dab25bd04598a5139d17b4d7b61a1bf5f6cfcf
MD5 a5e56bfdc30f65790fd1555e10c85d65
SHA1 34ece761ce3ab0d2ee3a8a47d4d6c177cb5a4119
SHA512 bc67ad21143a9b9a1b204b0d5668f2bd4a66d0ef7591b83da6ee4cbbd5bbe3a77299626d7dace6816c89e4f9417a24233ced0dad99f8e701cf970ed12a1c35a3
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0bSj06zzbqvT5wUWd5Szx:tYmHN6+JrXmHN6+JrvorhnbG9wUWdKx
TLSH
T1BD576B5566E690FCE0BB91358A768731E6727C134E32934F03B8DA0A2F73A549D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3672-12-0x0000000000400000-0x000000000040E000-memory.dmp