ec56bbb6b50f7d029b4c739c95c8e6e07928af8ffbd7263fc7f39fd5cf5cbd4e

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_ff47debccac4bd9e60a64376c9a11476_amadey_elex_play.exe
Size 14.5MB
Sample260727-d775csvepc
SHA256 ec56bbb6b50f7d029b4c739c95c8e6e07928af8ffbd7263fc7f39fd5cf5cbd4e
MD5 ff47debccac4bd9e60a64376c9a11476
SHA1 08b649aa20fce2350f1c7e3c9a40f39a583d77f2
SHA512 bb26e1727b519a7e791f52b0821cea4ca87947176b1c481a3dbba521c8692ae572f4fd1125d3c2ad45103bbaa0e849b0cce465178fd2c3a9514797d048f4db66
SSDEEP 393216:RxdrR0T74JKOAL4jKsqBfFH8IPu5WbmeEp1:R7rRA74JnAL4jyNlBu5+meE
TLSH
T1CBE6334D9580E4A5C4DD793C4BB26EBA4E6F39F0E3B661DB3B854BF145301CB9A31A08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_ff47debccac4bd9e60a64376c9a11476_amadey_elex_play.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_ff47debccac4bd9e60a64376c9a11476_amadey_elex_play.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_ff47debccac4bd9e60a64376c9a11476_amadey_elex_play.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ddraw.dll

Path C:\Users\Admin\AppData\Local\Temp\GatoXD_GBCompat\ddraw\ddraw.dll
Size 581KB
SHA256 557229268a252eeebab350f8837d10c89b40434aae79bd992d07e3de55280ecf
MD5 54e646ecc600f914eb3865f1257ad1c1
SHA1 ce22cea357b1a5d82560dfadee81abb7e079e668
SHA512 05a4f9e41658c908daf30b39a2d3ec6ee1a44e30bf5ff94c44abc596c6da2b2b5969d49eb4bc3aa129570bc7191b9a8aafa7c67a7965fe4d902ffd5b2933cbc4
SSDEEP 12288:yzuFHHATislj/SSMRVcyw0gTBh/1tS+fWXR:yz0HlnSQdgTXd3OB
TLSH
T139C4198036A2C53BE98912B48D28BE7F124C6AA307B555D7D3CC6DE62C792E35F32447
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download