2e82edb639b094a490f4da50f2e5cd02ae8881f5f0476876d001f5ae87555cdc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
Size 1.0MB
Sample260423-sa83qagt91
SHA256 2e82edb639b094a490f4da50f2e5cd02ae8881f5f0476876d001f5ae87555cdc
MD5 821264621c660ae0aa57376a0bb8998d
SHA1 da50b4c3800d6dfd56c767c342041fcedd50eb07
SHA512 f85a0a156af2d4dba45894c3e5cd768f8940efc4046c89f657ffff9aba4ce3eee0d9e3bdc5a12961f72950325ef7374ecf7cc2bbaf0603384f29d3669992ee36
SSDEEP 24576:rP/oXSaGyPjO7KX53RTh0tFda3TaewsAjLyx:MrGyrOO53RTqtiGljLm
TLSH
T12E359D12FBA0C032C67705721A66972AD57DB9200F6156C7E3FC9F4D9E302E17A3AB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Applications	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Applications\crashreporter.exe	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Applications\crashreporter.exe\IsHostApp = "0"	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Applications\crashreporter.exe\NoOpenWith = "0"	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Applications\crashreporter.exe\NoStartPage = "0"	2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_821264621c660ae0aa57376a0bb8998d_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads