424960c05e28a1cc670e4e3a4e2395b1866010354ea1793bbe1a37f62953dac9

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_79525b10fc5de2a30e8f021c7835a2d9_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260711-e3ta3sdx8w
SHA256 424960c05e28a1cc670e4e3a4e2395b1866010354ea1793bbe1a37f62953dac9
MD5 79525b10fc5de2a30e8f021c7835a2d9
SHA1 b3eb2fa8b5481cf510008c6a5b16624582d7bcfa
SHA512 9a45f0fc15cd2597ae7ba9f2e7d8a46caf410573c8a8c778f2cd44793e1cfb9ac9e0a7042abbd1198ea3cf3b2b9eb25dc65a0e3ba4f59fe16c9cdcf7528e69bd
SSDEEP 49152:wDD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL4AOcgOOM4Fa0tK:ED0FZs/U73MQ+fCi6AeeA8uxV1X8S
TLSH
T1A0B5B033F590907AC93313315E9D736C76A9BB710F36428722E55F2D2EB05C36A296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5868	4744	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_79525b10fc5de2a30e8f021c7835a2d9_bkransomware_elex_icedid_maze.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-11_79525b10fc5de2a30e8f021c7835a2d9_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_79525b10fc5de2a30e8f021c7835a2d9_bkransomware_elex_icedid_maze.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 620
  2⤵
  - Program crash
  PID:5868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4744 -ip 4744
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4744-0-0x00000000028D0000-0x0000000002A22000-memory.dmp

Download