f0676ac7170927d9babe72b11180cc9904e7d52a57f4e95bfc137408b5253fe8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_5238a83f892cb6a181c08a91e4eaf43e_amadey_bkransomware_elex_icedid_maze_smoke-loader.exe
Size 916KB
Sample260602-rrj99agy5m
SHA256 f0676ac7170927d9babe72b11180cc9904e7d52a57f4e95bfc137408b5253fe8
MD5 5238a83f892cb6a181c08a91e4eaf43e
SHA1 dbb080b25a9054af67262fd78dec1e21bd6f20a6
SHA512 34833ba37266dff1631273ec4654d660fa20b2362a44e0893ec514efd118118777b13ddb7c59b57c7b0d72a10503438f45e73bef78bf857e674d35d241a342d1
SSDEEP 12288:ndXgp6z4FKsN2E6LZ+Ym8SNckOd+BBaFRSYzzhoQZo2SZ1D/SaL:nFg6z4FK5bLwYm8ScVdDPZO+o2sJL
TLSH
T186158D1376D5803FE27302314D2DA62492BABC701935A74777E96B2D1BB45C2EE34BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3348	2120	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_5238a83f892cb6a181c08a91e4eaf43e_amadey_bkransomware_elex_icedid_maze_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-02_5238a83f892cb6a181c08a91e4eaf43e_amadey_bkransomware_elex_icedid_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5238a83f892cb6a181c08a91e4eaf43e_amadey_bkransomware_elex_icedid_maze_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 556
  2⤵
  - Program crash
  PID:3348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2120 -ip 2120
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads