Overview

overview

6

Static

static

1

2026-05-23...os.exe

windows10-2004-x64

3

2026-05-23...os.exe

windows11-21h2-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/05/2026, 21:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_31bcad0f8e84fdb7aad88be4c4ff9f4e_darkgate_elex_glassworm_maze_remcos.exe
  • Size 2.2MB
  • Sample260523-zyemcaav7p
  • SHA256 63d2f58370eb893332100a9dd82d00b7133f03b2e69ef20d0c89a4e02cb83e35
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_31bcad0f8e84fdb7aad88be4c4ff9f4e_darkgate_elex_glassworm_maze_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_31bcad0f8e84fdb7aad88be4c4ff9f4e_darkgate_elex_glassworm_maze_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 2KB
        • SHA256 26f319a168dbf9ec2dd08501b6b7d269d3706c2d67dfd0038f68e7a1be2ee4bb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 5KB
        • SHA256 8331c612276cd7fc4cc98d1659bedb979c90c8edd680fc01b38ece15d505cf7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 644B
        • SHA256 dcb262fe5adb32a4d4b249d7c67e923788694be3f2d05bde3decc7f35c58bb5d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 960B
        • SHA256 17382b2e7b96542371b616487e4eeb39c122e9f462aa2b609ab43cfd88364f8b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 3KB
        • SHA256 a3142035d743671eba7e5dc59dbcd30c60fc19a6acbc35fd5e74c860a5024483
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 7KB
        • SHA256 3d958ab31dd888f3d57e5b831752a0258e4be30129e606d2cd8766825c0d7f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download