5457f8bfa3ddeee338d2b1bb78fbf325a8f21b6695b0d32a926f87403586693f

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
Size 5.3MB
Sample261027-e5dy6sys7j
SHA256 5457f8bfa3ddeee338d2b1bb78fbf325a8f21b6695b0d32a926f87403586693f
MD5 e2597aaa95cf1051d45f04f9c802ae78
SHA1 acebae806baa47d7566915577a5a7207842d5301
SHA512 bfc9eac6e17d1f7eca72357c8c3db77ebfc2c49523a65e357b8cbeda8ec9a1822c692d7d51ac940a1b85fce6dc7ec0382fc7cbea5f37b6723b8d4846fa6b1e8c
SSDEEP 98304:hDwa5kP0NK8A7DuREfpEyk9lfNJ9ZCqgJwSLAiEs6g7eYtIuaNveKh:hDwtb7KEfbwSEZg7eYlaNveKh
TLSH
T14146DF21BB858071E8A201B05A6DAFBB447DB6352B7508CBF6D41F6E58709C37A36F13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e2597aaa95cf1051d45f04f9c802ae78_amadey_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads