5a357f1b2d10cac00c79b10ece5f751d2b9d9bce6d6a1b24b0fc72eddea2bfff

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_54fbc5e6f40dbc909ae8e2a20f3109ec_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
Size 3.1MB
Sample260415-tx3d5af13y
SHA256 5a357f1b2d10cac00c79b10ece5f751d2b9d9bce6d6a1b24b0fc72eddea2bfff
MD5 54fbc5e6f40dbc909ae8e2a20f3109ec
SHA1 5d00a56069e5eb477eef02e195a3ee5033a0e109
SHA512 b474735927821ef41a1753d868194f98690aea02ff073e060cc021973a7985a7797f8119e32024084addbd23f9744d6936d98ba44a52a08a142dca15f7cc7bd5
SSDEEP 49152:hljyakOElMaFLk+Ep6sBMO+YrovpU/97WWhipXq:iak7ypSOgho
TLSH
T101E57C38FEB08C36C16A95B06A6AA35EE1747D304BB0458B53547A6CEE71FF05E34326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_54fbc5e6f40dbc909ae8e2a20f3109ec_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_54fbc5e6f40dbc909ae8e2a20f3109ec_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_54fbc5e6f40dbc909ae8e2a20f3109ec_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4304-0-0x0000000001060000-0x000000000111F000-memory.dmp

Download