2c686df3e774dcc2ae5d15ad27da8cc24676a9a66fb370fd3423a92d8788ed98

Analysis

max time kernel
7s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader.exe
Size 98KB
Sample260820-cdb96axhpd
SHA256 2c686df3e774dcc2ae5d15ad27da8cc24676a9a66fb370fd3423a92d8788ed98
MD5 1ae32aad7d90e70887461362cca8e3ae
SHA1 302e3d8d46254770abf0d05dfbe26bf10a2e730a
SHA512 4e9306e3909c7c55dafadab6b5033657433401a2a85bca9a48e72dfdbd4cf2638f1e104098032f5d6e710a99afab143a77a6f67c8e32db38a924126bac426cb5
SSDEEP 1536:rvfCVk5QM0VzTMZWGYWSJHb+C47VBCO3nO9gIwcCrlNsWjcdwNTE:rH7QM4ypYXKC47LCO8krlyET
TLSH
T18EA37D1277D18075E0B30A315CA98E62463EFD764AB18E5FB394018E09746D1AB3BFB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6868	2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_1ae32aad7d90e70887461362cca8e3ae_bkransomware_darkgate_elex_helloworld_karagany_maze_rhadamanthys_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads