blackcat | df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c

Resubmissions

09/11/2026, 23:05

261109-221ebswvdt10

22/03/2024, 12:18

240322-pgvl5adh7z10

Analysis

user interaction
yes
max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
09/11/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
Size 12.6MB
Sample261109-221ebswvdt
SHA256 df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c
MD5 a0cd8aa1cd7cc61d41977cceacd7d4f6
SHA1 83078ff956e5e441429257cfa3a3362d6ba3c0d5
SHA512 2f147b25d3289f33623dd3fdfd339de75b71cab4eb6348d0a176815bc1a7a86889113c40b6b1d3a2eb275fd76c16dbbe0eb38e63584ce2f5005a13c7369e68db
SSDEEP 196608:zRXBBaGSqkZRLVupoP3/ih4a4kZLm77gZ9rwaATAZjiEjOvonfT:p/+j/ih4a4k9M5kjiOOvonfT
TLSH
T100D67C99F44BE9BDFA7E7070747EAB3299A4042850172D77CA96CCB1A28E7703C4C51B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery blackcat ransomware

Malware Config

Signatures

Family: BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
ransomware blackcat

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe

C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
"C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2872

C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
"C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe"
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3964-1-0x0000000000F30000-0x0000000001BD0000-memory.dmp

Download

memory/4536-0-0x0000000000F30000-0x0000000001BD0000-memory.dmp