fd6f93bb1cc3bf5193b5c1b760b9aa66eee11e95c0fc5bff17bb581f905acdb5

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_4cfa98293df5e24ec409539c28fdbb1f_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
Size 15.2MB
Sample260910-vpehrssgpd
SHA256 fd6f93bb1cc3bf5193b5c1b760b9aa66eee11e95c0fc5bff17bb581f905acdb5
MD5 4cfa98293df5e24ec409539c28fdbb1f
SHA1 c0bf7dc4c8640b591f5eaa778b778d2f80fc094d
SHA512 0bfe455e629486de54d6a595cb6123baefb6851ccc28083a2cb7191e3a220fc8f7e2d3b1462fb2fd4f6ef2a6357880511d2a8e73fa5487dd42b19ad7c520b1db
SSDEEP 98304:3pic7pcdSp7HpihdSdbpijA91pH2WpjHrgBFFu416AWv0+4jZpit+4jfpiBpiz+4:SdQOdSdmmHpn6F44IAWvCj0jZjCd4
TLSH
T148F65A1173E651F8F1BB96359A758331DA767C224D31834F13A8DA0E1E72690AE39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_4cfa98293df5e24ec409539c28fdbb1f_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-10_4cfa98293df5e24ec409539c28fdbb1f_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_4cfa98293df5e24ec409539c28fdbb1f_amadey_cobalt-strike_elex_glassworm_hawkeye_hijackloader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

integrator.exe-

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe-
Size 21.8MB
SHA256 baf15c6df30e16fba57799af682d817f68a5f463f2d308a32165d8c4ef13db27
MD5 a312c142068cc961f0878286ef756cef
SHA1 c31b0787872e4a85399b4d18772536ab36be0126
SHA512 3083743147c35cce8215f74c4e38b898afb454c7a69776e7ea1a3a591ec478d50ff04236983a594db3d09e4ce50271f08a488b59080c255b223b46f90234ede7
SSDEEP 196608:SdQOdSdmmHpn6F44IAWvCj0jZjCdjzzbqvT5wUWd5Szr:omHN6+JrvCgVUnbG9wUWdKr
TLSH
T1DD375A1567E591F8E1BB92348E768731E6767C124E32934F03A8DA0E2E73A509D39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3292-10-0x0000000000400000-0x000000000040E000-memory.dmp