5f52e952f4a2815a3de0fe0961c442850c1ea5c8a71cd0b43305025ce6d8b76e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/05/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-23_db1c144ec81909baa1bdf768ed318344_amadey_bkransomware_darkgate_elex_glassworm_hawkeye_maze.exe
Size 1.5MB
Sample260523-wpj9paa151
SHA256 5f52e952f4a2815a3de0fe0961c442850c1ea5c8a71cd0b43305025ce6d8b76e
MD5 db1c144ec81909baa1bdf768ed318344
SHA1 674325f904fc6a31108e6172a4d316c5623e3b40
SHA512 54500331885d4a60cd5173f2a1431804fddba5adb8de0cf81349d72bfbcbf2839209b1037d8bde8ed58c660a65e4087bdf0fe64296431f51a6e834c85072a593
SSDEEP 24576:d6BorRoNk7BZph59FF96X0JxQzMaewsAj8CrYn5v:YBorRokpH4ljvY5v
TLSH
T149655A2177A093EEDE732471CD69C3766828BD600B20F6DB625C7B5D9D30EC0A53B626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-23_db1c144ec81909baa1bdf768ed318344_amadey_bkransomware_darkgate_elex_glassworm_hawkeye_maze.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
864	2026-05-23_db1c144ec81909baa1bdf768ed318344_amadey_bkransomware_darkgate_elex_glassworm_hawkeye_maze.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-23_db1c144ec81909baa1bdf768ed318344_amadey_bkransomware_darkgate_elex_glassworm_hawkeye_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-23_db1c144ec81909baa1bdf768ed318344_amadey_bkransomware_darkgate_elex_glassworm_hawkeye_maze.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads