ef2fe644468aa2090e5cc26a2761a241b11960924b1f9255a0d3770df359a69c

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe
Size 5.2MB
Sample260424-g17rssht3y
SHA256 ef2fe644468aa2090e5cc26a2761a241b11960924b1f9255a0d3770df359a69c
MD5 fdb455949ceeeecaff1645b5bac8e694
SHA1 8fd8601871883ecc073711d1b0ba1ca1ebd102ef
SHA512 24bb0df998946c7d4a8da7f6596f6a53a65cc0141e3b687329a6ea5de47728fc29800a1a85604ecaa10bba007603bbcf09516ab0226ac3872fedee538bb7b6b2
SSDEEP 49152:uqatglZh+ZkldoPK8YahFHRZj4p67pbiFxMut6O9/Hc29TLPj6F7oXw9LNIVmkzv:8j2cPK8xbP7pc1/tr37woT
TLSH
T1F4465C0667A880B0D166C1754A22A64EE6717C0DCB339E9B06905DEEBFF37E05E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe
2600	2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_fdb455949ceeeecaff1645b5bac8e694_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000002320000-0x000000000239A000-memory.dmp

Download