1575216d60439165a4f2d01bb5e37ba8b869709287e6d8e43b5d1e6c5ba3d101

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_6709755b66c96bce26a41c037124ccb1_darkgate_elex_remcos_vidar_wannacry.exe
Size 665KB
Sample261014-ythb1a1xes
SHA256 1575216d60439165a4f2d01bb5e37ba8b869709287e6d8e43b5d1e6c5ba3d101
MD5 6709755b66c96bce26a41c037124ccb1
SHA1 4e140d79f977f61c95a6081cc1d29cc8dab0f95f
SHA512 a89f9d8c921566f77784c236f47fb1e92ebea1f56ea83df66929c96966a2ff90b209336dfd7f157efc82a2e73359f98b0517ec296888573a3e9e43656f037c94
SSDEEP 12288:9T1BTrVdZnPX542J17agcSLM74kNZQczUB2R77yllpDANgA5aJ8u4zhwZ3BwS8x2:9T1u8AKA5anIcydWXkI
TLSH
T10FE41632A3F18A22F832307095A7657AA599FD201B44D6DFB7C07C253E322C2F676765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4424	4124	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_6709755b66c96bce26a41c037124ccb1_darkgate_elex_remcos_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-14_6709755b66c96bce26a41c037124ccb1_darkgate_elex_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_6709755b66c96bce26a41c037124ccb1_darkgate_elex_remcos_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 232
  2⤵
  - Program crash
  PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4124 -ip 4124
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4124-0-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/4124-1-0x0000000000400000-0x000000000041E000-memory.dmp