030c32fc8926cb74040a6b7cc64a20e8846985b787ac4d04cbdf25f82e4073d2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-12_07896af812d6e92cfc29b5566b53cdaa_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
Size 13.4MB
Sample261113-kth2mssx2p
SHA256 030c32fc8926cb74040a6b7cc64a20e8846985b787ac4d04cbdf25f82e4073d2
MD5 07896af812d6e92cfc29b5566b53cdaa
SHA1 b2d533f8c26760ba60f2ed1c3362712caa4c78e8
SHA512 57567a84ed848ee358864ab845e812b8521dce82bc0522546120bf1e4c88004e0d2413d6a48ea11226dd95e200ece4edae537ea3add967d72d840837d11a52a9
SSDEEP 196608:Bp6+6Eu7b7gEmTXExpS0hM3azc+iyv0H2iL1VIr0shkQ0B:BR1u7fm6hMqzci0WinIr0shl0B
TLSH
T1E2E601136284C02FD0634A3E8DE799A4377FB7241B258CE76BE41BBC1F35681E91664B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	5952	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-12_07896af812d6e92cfc29b5566b53cdaa_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-12_07896af812d6e92cfc29b5566b53cdaa_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_07896af812d6e92cfc29b5566b53cdaa_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5952 -s 560
  2⤵
  - Program crash
  PID:3840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5952 -ip 5952
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5952-0-0x0000000000400000-0x000000000116D000-memory.dmp

Download