4290543b0db85326cc483b2224df6926e7a633fb303337909a138377e229a993

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_0e7a9e337ee0d2811a64b6b970b436e8_darkgate_elex_remcos_stop.exe
Size 472KB
Sample260707-3ph5ysf15v
SHA256 4290543b0db85326cc483b2224df6926e7a633fb303337909a138377e229a993
MD5 0e7a9e337ee0d2811a64b6b970b436e8
SHA1 bca6eb6a74b2d55f82752f385706bbb6d19fac84
SHA512 7257b3c51d1fc06463b96f342f7518c4bacae7a447106d5e577ba6d5d64a68fb8ab2354f8941723f648389345564341850ed130ee1a2a363d027de41e42db328
SSDEEP 6144:o3xQgqQ6obq2vSc9m3KJvcCZew4j9U8YYFAmgt/pUXLR3x2X+RoULBb2u:sQgLJFqc9mv9NYcAmgMXloyoULx
TLSH
T18EA45C147690D036F5B314B58EBEC6799A7CB8611B3491CBB3C04EBD1EB1AE2A931317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_0e7a9e337ee0d2811a64b6b970b436e8_darkgate_elex_remcos_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_0e7a9e337ee0d2811a64b6b970b436e8_darkgate_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_0e7a9e337ee0d2811a64b6b970b436e8_darkgate_elex_remcos_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Roaming\.logon\login.log
Size 1KB
SHA256 436b8e3332b26bcaded892aaa7968f39e9c13643ef13df6c21de5ab1b3086002
MD5 95df55ffbbf7faab11c654ab4fc58c1d
SHA1 896801353d2406be44e52b9a0657a2bf49dc7429
SHA512 b796ea7a8c8e053c841a7d9ae197fa27b7828c5b3bc772dce5a25298ca9cec4f2c10bcf574f0015f917835b22c1076fb766d2ed8acf5c17b9bf3dc42773941a2
TLSH
T147315F52129ECDA74011032AD75FBCC5DE25F8AB21185A742BB77F6C7C41B14BAA34A2
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\.logon\login.log
Size 560B
SHA256 e5eeec98d3b26bf744463c16aa3a0d9d61e85309027df999d621007b7b77e536
MD5 e7c70110d636fd03bcd71e58813432cc
SHA1 1e605cea7f5e9efb8d877f15583640406ef6503c
SHA512 b7d9fb5576c4379417be76200931d5819ae2b8b80ef206125cfb5d74b98a8188f22fcd752fb65d4cf2c53b1312e833af71304fcd875bf5ec27877aec756f1b3a
TLSH
T13AF02452516D8DA2401112379A6B78C9ED25E44F222C16342FBBBB683D48704BAA2462
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5068-0-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5068-1-0x0000000000448000-0x0000000000449000-memory.dmp

Download

memory/5068-23-0x0000000000400000-0x000000000047A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads