Overview

overview

7

Static

static

3

2026-04-19...er.exe

windows10-2004-x64

7

2026-04-19...er.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 12:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-19_3162f191a0e8f7d3392a22af02f96b63_conti_darkgate_elex_gcleaner.exe
  • Size 305KB
  • Sample260419-n77tpsev8x
  • SHA256 2642643236ca6c8dff699a051a0d65169cbf77df5ea6721014fcbf75ece4101f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 54 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-19_3162f191a0e8f7d3392a22af02f96b63_conti_darkgate_elex_gcleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-19_3162f191a0e8f7d3392a22af02f96b63_conti_darkgate_elex_gcleaner.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3392
    • C:\Users\Admin\AppData\Local\Temp\2026-04-19_3162f191a0e8f7d3392a22af02f96b63_conti_darkgate_elex_gcleaner.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-19_3162f191a0e8f7d3392a22af02f96b63_conti_darkgate_elex_gcleaner.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 436
        3⤵
        • Program crash
        PID:5464
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 436
        3⤵
        • Program crash
        PID:4488
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 484
      2⤵
      • Program crash
      PID:928
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 484
      2⤵
      • Program crash
      PID:4128
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3392 -ip 3392
    1⤵
      PID:5396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3392 -ip 3392
      1⤵
        PID:1188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3664 -ip 3664
        1⤵
          PID:480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3664 -ip 3664
          1⤵
            PID:384

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX24DB.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX24DB.tmp
                • Size 819KB
                • SHA256 8427a5bc198b6a90e3be49e0917fb5ac6a95961953a72427385b8fff1ce73336
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX40D9.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX40D9.tmp
                • Size 4.4MB
                • SHA256 83e89b561ba697b5eebcb5b91604aed2b45ee635fa6bbfb38e789c0101cd68db
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX46E2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX46E2.tmp
                • Size 324KB
                • SHA256 86b87649ed62ec4843d8ab8fa0b026e392e3dab4895674ae058401d11184ae13
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX4F6F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX4F6F.tmp
                • Size 308KB
                • SHA256 7a8fbd42cf61b5839278f4c8ca9c6a61ecdf9ffc970ef7ac652fb8cb94f3f20d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2FC5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2FC5.tmp
                • Size 305KB
                • SHA256 2642643236ca6c8dff699a051a0d65169cbf77df5ea6721014fcbf75ece4101f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc320B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc320B.tmp
                • Size 284KB
                • SHA256 8279ba4ccdb145abccd147b23225e495868d8a6e8be00e2be631adca11113cb2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc321D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc321D.tmp
                • Size 2.4MB
                • SHA256 a2587f47b6953a75f2fc46e2998aa7e8326e8cbab00afbeff5a727c93ac694af
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3230.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3230.tmp
                • Size 551KB
                • SHA256 726c31c0a95ff8766e9d5b9960fd8ef12d5a9bffab422653ca621fc4cc4fb941
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3233.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3233.tmp
                • Size 317KB
                • SHA256 4233988f3722d99717bec7e941cd19b052fab325768e2ec71955a5614742f210
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3255.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3255.tmp
                • Size 4.4MB
                • SHA256 38bc79e3eacb411efdc2a975b7c4aa26b98fb040ce5e05f480ef86be1c53fc3e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3E7D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3E7D.tmp
                • Size 629KB
                • SHA256 20eb796b9fde919a3e72e22a7a830ccd2f50fc120e180714ed923f06100bd1c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3EDE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3EDE.tmp
                • Size 23.8MB
                • SHA256 96c599c2754969eff47a42ec404c9839ac2b1646b067c7ab24f4ecd3877d9e80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/3392-463-0x0000000000400000-0x0000000000456000-memory.dmp
                Download

                memory/3392-434-0x0000000000400000-0x0000000000456000-memory.dmp
                Download

                memory/3664-464-0x0000000000400000-0x0000000000456000-memory.dmp
                Download

                memory/3664-571-0x0000000000400000-0x0000000000456000-memory.dmp
                Download