56be773c411c7cddd1f60b4c8f7059b7fa732100b4c45d37d0ded8818c80939c

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
Size 250KB
Sample260504-lp8beafx31
SHA256 56be773c411c7cddd1f60b4c8f7059b7fa732100b4c45d37d0ded8818c80939c
MD5 75d8a6af08a3573c02e790ab84c37698
SHA1 a47743f7446c166c767dca7b65055fa4a1690d00
SHA512 c6268744c623fcb30ba2907901aa995cd865c715be62614354065237e38f7fdcb4658bc431a54701613f4cd8e73a501fd45b79b896f790152d2469d1fac3fee0
SSDEEP 6144:xFQ4afbQz3TOe6my2PcOq6KpCHNN9KJcfh2m71Z9aJ8j:xW4m8ntvp71Z90A
TLSH
T14E44AD22F2D0D076E1A30AB45EBEA671643BFF215A34465F63E43F0D9D743A0A916363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Mail\wabmig.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Mail\wab.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmplayer.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Media Player\setup_wm.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2532	4660	WerFault.exe	77
4016	4660	WerFault.exe	77

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
4660	2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_75d8a6af08a3573c02e790ab84c37698_amadey_darkgate_elex_gcleaner_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 500
  2⤵
  - Program crash
  PID:2532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 516
  2⤵
  - Program crash
  PID:4016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4660 -ip 4660
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4660 -ip 4660
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX43BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX43BD.tmp
Size 257KB
SHA256 17ce130c675c0ca76c2d2c81a8d723a1eee2c32214b83ff8914cfe5b78274987
MD5 1932ff3821d2e351d029b1e23a7eb2fd
SHA1 aa85c2f72493489aef4ada5b0541924c8c8f8541
SHA512 62edc2b792112af3ea2fcacae3cd601a3a7c97da0b40f7bd2755451cb5a486cc62801eeab56dc6e30848a55db5356ff59f340580b9ccbbd0968c8120ac9014b8
SSDEEP 6144:6FQ4afbQz3TOe6my2PcOq6KpCHNNik96dADD1Z9aJ9j:6W4m8ntRL1Z90x
TLSH
T17144AE22B6D0C077E1AB0BBC5EBE5671543ABF101A34455B63E43F0DBDB47A0A90635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX442C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX442C.tmp
Size 197KB
SHA256 fad08767ed3e56360e1d72d0cf27eb8f1f2fcf2621d9a87f0033af1b742d171e
MD5 ee4802151535054acf0d614f2a4e4581
SHA1 ad74343131281f146c54cd0b9bbe92d9f1fa2ea8
SHA512 0c3ff7fdbdd233c5debe9e8b7275815f1f4ba763a9d137d2b11fb3d7383f0e2df44c75c8b4795677b358c51656bc873f6359a3c2fa20fa5d2ddbb75ba00d87a6
SSDEEP 6144:KFQ4afbQz3TOe6my2PcOq6KpCHNNlaJMj:KW4m8nt30w
TLSH
T1E4147C36B2D4C477E1E30AB05EFDA672583ABE515E34815BA3E03E0D9D743A0A916393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc2110.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc2110.tmp
Size 250KB
SHA256 56be773c411c7cddd1f60b4c8f7059b7fa732100b4c45d37d0ded8818c80939c
MD5 75d8a6af08a3573c02e790ab84c37698
SHA1 a47743f7446c166c767dca7b65055fa4a1690d00
SHA512 c6268744c623fcb30ba2907901aa995cd865c715be62614354065237e38f7fdcb4658bc431a54701613f4cd8e73a501fd45b79b896f790152d2469d1fac3fee0
SSDEEP 6144:xFQ4afbQz3TOe6my2PcOq6KpCHNN9KJcfh2m71Z9aJ8j:xW4m8ntvp71Z90A
TLSH
T14E44AD22F2D0D076E1A30AB45EBEA671643BFF215A34465F63E43F0D9D743A0A916363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc2D1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc2D1E.tmp
Size 241KB
SHA256 00054574ca6929212316ea359ed98f83bbd46b9adec178de1e6adbb05d81c710
MD5 34128f9fdba35d4254831ebe9d10b2bd
SHA1 06f61e970dcd94c93c08d412a6ee61ba004ff3cb
SHA512 90c0820f8d5203e09e0482012bfa1858ba54c5c6db8dcc49f48c2645a86065bf1337bc28d87b31cb55db141de14f12499db5c3e328f5ef42d40c856a27a5a2c2
SSDEEP 6144:DFQ4afbQz3TOe6my2PcOq6KpCHNNNw1rOt9pdYamXyaJ3j:DW4m8ntY5OLpdNb0T
TLSH
T18E34AE26B2D4C436F1E30AB45EBEA636543EFF511B28451B63E41F0D9EB43A0AA17353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pUc346E.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc346E.tmp
Size 327KB
SHA256 592afe7d87cdb01f1d3bdc1175e7bf348a38928b5d6acd2a8fb6f82a9c616449
MD5 9bee409048b6ed2498337e286098be32
SHA1 19edfb817bb1d391edc84ff9ca94d169692e9924
SHA512 da6e38f6c0473102f7fe93d667ed404b2557cd52eec2c2eb3d247bcac963cacdc20d68d1ab4219615abaa7629d612dd0212746275f0bfdbd4370fdfbbb8764eb
SSDEEP 6144:8FQ4afbQz3TOe6my2PcOq6KpCHNN0KJcfh2m71Z9aJoj:8W4m8nt6p71Z908
TLSH
T1E3646C32B290C476F1A20AB45EAE9571543EBE112E27CD1B63943F0DBF742D0A91639F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-355-0x0000000000400000-0x0000000000449000-memory.dmp

Download

memory/4660-458-0x0000000000400000-0x0000000000449000-memory.dmp

Download