5e919eac3d64615dc9078fed8c279fd9f3a84dcff84d00d5f31917ddad0701d5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 03:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_5281c6e285062263e1e465175b96d993_bkransomware_cobalt-strike_darkgate_elex_icedid_maze_njr.exe
Size 760KB
Sample261113-dkxecafw5j
SHA256 5e919eac3d64615dc9078fed8c279fd9f3a84dcff84d00d5f31917ddad0701d5
MD5 5281c6e285062263e1e465175b96d993
SHA1 47919cec7045a6495a02d27188285e91a3be6a7a
SHA512 131180734be394bbee51fcb244cde36c6d69191035ff35d3cbc1abdef3a1cb03fcbef5877f9beca2ef0296a9d07943b302575a82968f1723aeb7cd2b827dccd6
SSDEEP 12288:ntOw6Batkss8WBTGv5aXXsf3Gu+clNsfCNc1rO:d6BPss86TY9Uclqfh1rO
TLSH
T1DDF4E453E29440A1D45E6130C75E8A16F673BC1E07E0961A16FCEB3E1F326B069FDA27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_5281c6e285062263e1e465175b96d993_bkransomware_cobalt-strike_darkgate_elex_icedid_maze_njr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1192	2026-11-12_5281c6e285062263e1e465175b96d993_bkransomware_cobalt-strike_darkgate_elex_icedid_maze_njr.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-12_5281c6e285062263e1e465175b96d993_bkransomware_cobalt-strike_darkgate_elex_icedid_maze_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_5281c6e285062263e1e465175b96d993_bkransomware_cobalt-strike_darkgate_elex_icedid_maze_njr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads