a5a3d05648b9a708d9bc8bcbbf8329888fe7b3ac15bc23d76ec1bf91bd39e699

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_748c2d677d404298c5c9d09c6240c993_bkransomware_cobalt-strike_darkgate_elex_hijackloader_ma.exe
Size 1.7MB
Sample260522-tpbansbx3w
SHA256 a5a3d05648b9a708d9bc8bcbbf8329888fe7b3ac15bc23d76ec1bf91bd39e699
MD5 748c2d677d404298c5c9d09c6240c993
SHA1 37e5d92bd1deb4d67dfc350d36a3e7ffe8bf339f
SHA512 c70f6b9a082bd7d5f908d23bd7ab9b856cd203ee0675521cb72abadc80bab34e666960d9ffe8d8fe00d25c3e4174eb2fc6b09701e4a0a17d55b60094c46626ec
SSDEEP 24576:d6BHBSI8LUlFl5FpI59FF96X0JxQ+D5TvinrmyrCn5W:YBLcY/yb56rNC5W
TLSH
T11985A51126A10FB9DD679630C465E9BD65277D109E33EF8F21893D8EFBF0A815827232
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_748c2d677d404298c5c9d09c6240c993_bkransomware_cobalt-strike_darkgate_elex_hijackloader_ma.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	2026-05-22_748c2d677d404298c5c9d09c6240c993_bkransomware_cobalt-strike_darkgate_elex_hijackloader_ma.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_748c2d677d404298c5c9d09c6240c993_bkransomware_cobalt-strike_darkgate_elex_hijackloader_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_748c2d677d404298c5c9d09c6240c993_bkransomware_cobalt-strike_darkgate_elex_hijackloader_ma.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads