4f2b83cf21b316dde524154841961f15e7aa88b38851cab3f2b543115890b6b4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_f393303132063b4d470c20cb8f318e1b_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 24.9MB
Sample260910-b3c3bav1as
SHA256 4f2b83cf21b316dde524154841961f15e7aa88b38851cab3f2b543115890b6b4
MD5 f393303132063b4d470c20cb8f318e1b
SHA1 ce1b4ba151d734ae64521784f886cfaaae612400
SHA512 a1d5f6739876fc6ef6a2865f3beac1b343a72efd31f739cd0274dea8f558fb574765df6294ebabba072a09bcb54faa00a487ccfa15f9d1b6b66d559fd0304055
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0bCdamHpn6F44IAWve:tYmHN6+JrXmHN6+JrvoqmHN6+Jrve
TLSH
T16747396162E760FCE1BFD1358A3A8731E6727C130931934F12BCD65A2F63654AD29B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_f393303132063b4d470c20cb8f318e1b_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-08_f393303132063b4d470c20cb8f318e1b_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f393303132063b4d470c20cb8f318e1b_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 25.3MB
SHA256 2ef6e8110414767a9f3c7a459bd5530c66b14817fe5c495f2e85ab6864de158b
MD5 4556fb4ea081d287da967e11e698aee1
SHA1 fa001edb9aa24ea9b2c46e4257bed5b5c3137ad1
SHA512 95882cf93f65194d4c710599457e252aa51257dacb48708bbad9866c69a6f1c9ed27af7669faf992de02da60c86f0152b5612ecc0c264ac30e66b4cbc50df99a
SSDEEP 196608:tjDdTdMmHpn6F44IAWXmHpn6F44IAWvojkd2Zd0bCdamHpn6F44IAWvW:tYmHN6+JrXmHN6+JrvoqmHN6+JrvW
TLSH
T11B47495162E760F8E1BBD2358A3A8731E6727C130931934F12BCD65A2F73654AD29B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4772-10-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4772-11-0x0000000000400000-0x000000000040E000-memory.dmp