761fb7c60988196241657bea17049741bf4475a134d1a541c7e85d7600195ac1

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_4ceac83ba49013d09064d7eba2b4f614_darkgate_elex_glassworm_hawkeye_karagany_remcos_rhadamanthys_stop_wannacry.exe
Size 3.0MB
Sample260415-sg67psa12p
SHA256 761fb7c60988196241657bea17049741bf4475a134d1a541c7e85d7600195ac1
MD5 4ceac83ba49013d09064d7eba2b4f614
SHA1 9f0a4e1e907656aeb5c0578aa6871b83b000e1e9
SHA512 2b797a766cf0132661d5b8b1e25d917f6f2c9906feabb67814e30a47f745979f54b9b487ea31fa7abd7a9f04c4ce59327f0f5fd8b96bf21930421059f640e2f5
SSDEEP 49152:6M84p0DkYOMwwnMb4PmyVNydB3I60g7mM+M6RkMkIM7I067CsNBk9/fw2BwfmM0t:Df5YOXwnS4rVNWCXM+M6RkMkIM7BsNin
TLSH
T163E5AF22F791E032C6B605701AA6E725653AFD311B1466C7F3ACBF4D2DB02C16A36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	4728	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_4ceac83ba49013d09064d7eba2b4f614_darkgate_elex_glassworm_hawkeye_karagany_remcos_rhadamanthys_stop_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_4ceac83ba49013d09064d7eba2b4f614_darkgate_elex_glassworm_hawkeye_karagany_remcos_rhadamanthys_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4ceac83ba49013d09064d7eba2b4f614_darkgate_elex_glassworm_hawkeye_karagany_remcos_rhadamanthys_stop_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 880
  2⤵
  - Program crash
  PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4728 -ip 4728
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4728-0-0x0000000000F30000-0x0000000000F3A000-memory.dmp

Download

memory/4728-1-0x0000000005860000-0x00000000058F6000-memory.dmp