7be97bc57ab65a516014c920c8a05d325b684618b75fc3c630207191fab32c22

General

Target
2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
Size 253KB
Sample260417-tfx33scs2k
SHA256 7be97bc57ab65a516014c920c8a05d325b684618b75fc3c630207191fab32c22
MD5 9d5f10d6bc0097c3d739529412a8ebb9
SHA1 62cf74cfb5442e9c7f474084bdc44d13010853b9
SHA512 da7e5b8a84b91db12ae7910e424ea2d3830c1e48abdcfa1e507a532dc952493211ec94392d6171a21a7673080f4c025ac3e0f61e75e1cc16c53fd26859503c29
SSDEEP 6144:NFQ4afbQz3TOe6my2PcOq6KpCHNNjKJcfh2m71ZJVC9Wj:NW4m8nttp71ZuK
TLSH
T1F144AE32F6D0C076F1A20AB45EBE9571643FBE111A264D1F63E43E0D9E743E0A91636B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
484	2380	WerFault.exe	78
3848	2380	WerFault.exe	78

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2380	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
2380	2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_9d5f10d6bc0097c3d739529412a8ebb9_amadey_darkgate_elex_gcleaner_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 412
  2⤵
  - Program crash
  PID:484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 500
  2⤵
  - Program crash
  PID:3848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2380 -ip 2380
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2380 -ip 2380
1⤵
PID:2468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pUc1A0B.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1A0B.tmp
Size 787KB
SHA256 30f1cd11b664b72c26edc7571266beb9f410e70ce44d677b61b877c443233a11
MD5 e28eba18a3806b4225bbc08313b4176f
SHA1 34ae1184ecc89775d3e5978f90645e1139676fc3
SHA512 27f3e5beb825eb35d9a39ae54f5ab67d762ffc9cd9561ddbcbbd862d68ad08096139a8688a2fbe5e2666c136a20c4195dd613ae3d7d30f781008f3f425fb95d0
SSDEEP 12288:lW4m8nttp71ZnXZNYVLeyUji0h90ZD0wxpGZIVuKrHsW:44mWzR0Le5ji0hmxNrMW
TLSH
T173055C26F6B48331D073C0B9C5D6A69AE97234811B308ACB4395D76C7F677E68636332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc1A1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc1A1E.tmp
Size 253KB
SHA256 7be97bc57ab65a516014c920c8a05d325b684618b75fc3c630207191fab32c22
MD5 9d5f10d6bc0097c3d739529412a8ebb9
SHA1 62cf74cfb5442e9c7f474084bdc44d13010853b9
SHA512 da7e5b8a84b91db12ae7910e424ea2d3830c1e48abdcfa1e507a532dc952493211ec94392d6171a21a7673080f4c025ac3e0f61e75e1cc16c53fd26859503c29
SSDEEP 6144:NFQ4afbQz3TOe6my2PcOq6KpCHNNjKJcfh2m71ZJVC9Wj:NW4m8nttp71ZuK
TLSH
T1F144AE32F6D0C076F1A20AB45EBE9571643FBE111A264D1F63E43E0D9E743E0A91636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2380-156-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/2380-157-0x0000000000880000-0x0000000000992000-memory.dmp