eed844cc5f6b1d6fedac7b6b05f96337fa228b520070d6dbec7ce161177a8f7f

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e6d1f4fcbe9b2911593aa8278918dffe_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
Size 909KB
Sample260826-e86hlascmd
SHA256 eed844cc5f6b1d6fedac7b6b05f96337fa228b520070d6dbec7ce161177a8f7f
MD5 e6d1f4fcbe9b2911593aa8278918dffe
SHA1 faa1bcae02ca70a30707ac1efc233e987c560e7f
SHA512 71012ccef3844d347a956ab8e358edd4ec081de2c611377d872792a3a377c97f037b601af7a33689a650ce14708031655c51bf0ca96660a69c70e447d64d93f5
SSDEEP 24576:NAHnh+eWsN3skA4RV1Hom2KXMmHa0yC5:sh+ZkldoPK8Ya0T
TLSH
T119158C0273D1C036FFABA2739B6AF64156BC79254133852F13981DB9BD701B2263E663
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e6d1f4fcbe9b2911593aa8278918dffe_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e6d1f4fcbe9b2911593aa8278918dffe_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e6d1f4fcbe9b2911593aa8278918dffe_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads