333d26b74f306460866888a85861930eba9053589ee3cd64e6c19b74a486c446

General

Target
2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
Size 8.2MB
Sample260716-2bmesafs6k
SHA256 333d26b74f306460866888a85861930eba9053589ee3cd64e6c19b74a486c446
MD5 901f160ac62f058629f2f59bfe70cd67
SHA1 14ba71ae23d74a2d98d39909e0c78daef6760fb0
SHA512 8bd0234a3e657041c08264e0ac1d7aa775c6a880b6e6301cb34c11d69844105541e12fa1c7e849d4286235f06374953cbc199981d22866969195beb6beaa186a
SSDEEP 196608:UjkmSpKnF5cx+HrejR9kt3TtyqCHMxEilr:Upnwx+HaDkt3T9ZX
TLSH
T11386232263DDC322C7769133FF2977402FBB38254630B96B2F881D7CA961162566C7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5552	ggzqjqviuruupaalvuko.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggzqjqviuruupaalvuko.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ggzqjqviuruupaalvuko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ggzqjqviuruupaalvuko.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 5552	1544	2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe	86
PID 5552 wrote to memory of 4428	5552	ggzqjqviuruupaalvuko.exe	87
PID 4428 wrote to memory of 4000	4428	WScript.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_901f160ac62f058629f2f59bfe70cd67_agent-tesla_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\ggzqjqviuruupaalvuko.exe
  C:\Users\Admin\AppData\Local\Temp\ggzqjqviuruupaalvuko.exe -p107891453931340269391955929707107052505320306846932232307527128588726760244486029147142115513003220463253876697715743
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:4000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

004.tmp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\004.tmp
Size 207KB
SHA256 d8ff4748434faf78ecab0b36763729afa770f2fa7347cee54438cf306c063b53
MD5 b4001b514ed843ab0b52e129ffb54205
SHA1 f4e038fecce8bf46654657648a96ee5a257cfe7c
SHA512 c413b342efd91885614727a787ff670975397bf020494c074dc9008b305c65d967adaa6aa5667607343a673914439b2ceb28748229115122abfb77fd0c14f477
SSDEEP 3072:8Pih2uq1aMKcfvi5F/br9pWD4F5n5K2R99yCvU2Nz69ulUWUi6W+Fg+n4EieQAFo:0xEcni5vDMRgzxdUi6Fg+fpFrhlM/
TLSH
T1F624AE6236D1C032E46355309DA99731E9B9B9352776A98FBFD00E2D3F31A92C316B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

014.tmp

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\014.tmp
Size 83B
SHA256 4ba286a2580a2a2b7ee696b13b0a04b59f82b04d5441b50d715a1c5f860e5253
MD5 ef29134d5abb8d5676b6e5ad42469fbd
SHA1 c2705afa4180a812df522602e06836f2e04d60c9
SHA512 073989a74f1dd1b15e4298edd8b94c1733da8096997b8055c294789e671f11de07ade856fc15b66614f526975dc7b18994e151a37b9b257002046c43baf2f206
TLSH
T130A0041511F3DC51C00C10740307CD505531141CC71053131DD0047DDCD104C45CD005
MD5 SHA1 SHA512 TLSH

Submit Download

installer.bat

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\installer.bat
Size 278B
SHA256 093461e22f257d8efef5757519833cca32b504c7169fc3e4b5a52b04a46ee1d5
MD5 c25310e0d2d9a2fd04728ae7e6b0e9c6
SHA1 1abe436d7c373ae85f5d1536837d0fb3a1bb1150
SHA512 509764a4dd967432839c5bc9af137915cd04d5a021ad6ee2a42b863a268f1c64e6e13f82509a223c778601a4764f39561f45b56d9843b130786e2c20f8f92889
TLSH
T142D0C71E38D2340AAF00FEA8C6C1C38C038AF53F0F1D90856501E760DA850CCC642103
MD5 SHA1 SHA512 TLSH

Submit Download

run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
Size 81B
SHA256 6a6e408a620e9281d17967a4a5d34548d090831cbea463aabf0f66f68b623dd5
MD5 9b0a98146b081c9359c91be85c61e6d0
SHA1 a9bbdd5f048f35f83af31ffad76dfad444039706
SHA512 2dd70246f91d5d8254e10200342a1460f22731e8343ccdd1d807e39a51f191629bd1b8dce9b91c22f444a533624e81876437df10632d41d2762ad8e9f9854067
TLSH
T12CA02410153FC5773F0DD1C40033443C47507F1010315C330740C04413131401333143
MD5 SHA1 SHA512 TLSH

Submit Download

ggzqjqviuruupaalvuko.exe

Path C:\Users\Admin\AppData\Local\Temp\ggzqjqviuruupaalvuko.exe
Size 7.4MB
SHA256 6952b05238175c4e8e99040ee0cd3b72fef3c2f8f6d94b9e9b7a743423b11961
MD5 184f1dde198a70d5a01ba69e6ae5ebe6
SHA1 c6a4986f544f436bc150375273df879a6331cf6d
SHA512 d672d018dd6d425830dbd7b158de52f9221ddf8275f90ac81405d03dfa8df19fcaabe25adaa272b337c7bfcf5c6d59f98d8cd4f8fdde06a71f77f905339ef1c1
SSDEEP 196608:gG2sR1P0Y2IP8Jaf8Hsb1X8lDdao6vS4gBtStZw0:2E90Y2IeS8M5O5XSzj
TLSH
T115763350B2B4C032F195C9365CD0A221ABFC6D222AB6AD9797D109387F32791D679F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads