23e2eaeeb1b8f2bf7eaff618ee9bae572f8b8bac03cd92539337c86e332c9a0f

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_942ca46de1f59b156a1fe6eed9a7d5a0_chir_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
Size 384KB
Sample260816-3c151abr2w
SHA256 23e2eaeeb1b8f2bf7eaff618ee9bae572f8b8bac03cd92539337c86e332c9a0f
MD5 942ca46de1f59b156a1fe6eed9a7d5a0
SHA1 08a4eeab0789f411e2ab0ae68951d5ea8e7da315
SHA512 ecf077d84d094a3716e69118fd1bd410a6e4960e58b093cd83010fcffc6bcaace1db1203846632a25f2b177e7d994ca242ee31f4296f7a319b13048516c3ce56
SSDEEP 6144:LVaS8rPUuhXVl3WWp7u/iFhvMOudz6HKgSbAFtqfAOCquMAEaZq:LVR4vLJQiFhvMGHSUMkquNZ
TLSH
T188849E207686D036D56201744F79EF6B643DEA604B6546DBF3D81EAE0E702D22B32F63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4716	3332	WerFault.exe	87
4064	3332	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_942ca46de1f59b156a1fe6eed9a7d5a0_chir_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-16_942ca46de1f59b156a1fe6eed9a7d5a0_chir_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_942ca46de1f59b156a1fe6eed9a7d5a0_chir_darkgate_elex_glassworm_hawkeye_luca-stealer_mespinoza_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 520
  2⤵
  - Program crash
  PID:4716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 540
  2⤵
  - Program crash
  PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3332 -ip 3332
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3332 -ip 3332
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3332-0-0x0000000000600000-0x0000000000669000-memory.dmp

Download

memory/3332-1-0x0000000000600000-0x0000000000669000-memory.dmp