fd779a81ad40ccfc65203ebba1816aca2ebc0debe5e8700392f25f00c5e7a0bd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_8ff94e62f0c12f1d60f39e19677dbe0b_amadey_bkransomware_darkgate_elex_hawkeye_karagany_maze_.exe
Size 2.0MB
Sample260522-vxmt4sbw4j
SHA256 fd779a81ad40ccfc65203ebba1816aca2ebc0debe5e8700392f25f00c5e7a0bd
MD5 8ff94e62f0c12f1d60f39e19677dbe0b
SHA1 38ba7871c8144e71ff3277e0731467d6a5b9c66f
SHA512 206c759466d90ed36525c583d928ba8a53b9450fd17e21276a2129dbd2333ff9af7e81f502f5bdfb1bfb07b69b1e1795397bd31b8d86a413c2659435457694d0
SSDEEP 12288:tAwSfxL/2Dc3jDLLRvXk1KP0sLvFZq3xSRe7BHvikYoyUGbKOxEXYGaYRD+bdGuM:e3k1KjZqhae16CGbfxEXYGaKqMuM
TLSH
T164A53800B6A84065EC7E4E758565A632F9317C4FBF3DBACB1E40B62A5E736C16931323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4292	1680	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_8ff94e62f0c12f1d60f39e19677dbe0b_amadey_bkransomware_darkgate_elex_hawkeye_karagany_maze_.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-22_8ff94e62f0c12f1d60f39e19677dbe0b_amadey_bkransomware_darkgate_elex_hawkeye_karagany_maze_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_8ff94e62f0c12f1d60f39e19677dbe0b_amadey_bkransomware_darkgate_elex_hawkeye_karagany_maze_.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 228
  2⤵
  - Program crash
  PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1680 -ip 1680
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads