b1b5d02267fdcc119fb30d1cd40c9747cca20e07460a47401488ec7d08719a1d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_9706318d74d5eed6b9e6bd270ca38f5b_amadey_blackenergy_darkgate_elex_glassworm_remcos_smoke-loader_wannacry.exe
Size 51.9MB
Sample261003-yfb8tsfb66
SHA256 b1b5d02267fdcc119fb30d1cd40c9747cca20e07460a47401488ec7d08719a1d
MD5 9706318d74d5eed6b9e6bd270ca38f5b
SHA1 d65826d27436af2f713ea25f5f13707f3c956b89
SHA512 3d768fa769462c5282c75860ba53c831c2806cca8f852ff23ebb08c9b58033d54f42b192f0fd83aad85a16bc66319e04fbe4a2a788a3fe49ed534e3a984c25d7
SSDEEP 786432:ZpkU9PgTeqUCeZDmNrW8S7np+qNW3Aip0Wino2ode397iEfZAezhyCICpRC:d9PgoCemW8SjT8QnWino1de9dBA8IGC
TLSH
T106C72363946E8070D28643B6C93E0AFD35B856114EA0C6B7DFC0DDE07D325E36AE761A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4868-0-0x0000000000400000-0x0000000003C84000-memory.dmp	UPX

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4892	4868	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_9706318d74d5eed6b9e6bd270ca38f5b_amadey_blackenergy_darkgate_elex_glassworm_remcos_smoke-loader_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_9706318d74d5eed6b9e6bd270ca38f5b_amadey_blackenergy_darkgate_elex_glassworm_remcos_smoke-loader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_9706318d74d5eed6b9e6bd270ca38f5b_amadey_blackenergy_darkgate_elex_glassworm_remcos_smoke-loader_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 652
  2⤵
  - Program crash
  PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4868 -ip 4868
1⤵
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4868-0-0x0000000000400000-0x0000000003C84000-memory.dmp

Download