Overview

overview

10

Static

static

10

2026-05-28...op.exe

windows10-2004-x64

9

2026-05-28...op.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    14s
  • max time network
    139s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    28/05/2026, 20:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
  • Size 12.8MB
  • Sample260528-yv3dkact2l
  • SHA256 6227f7a8286f897ecbfa570340b6cd22914f540606fa051e28d92b4a23abed29
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywarethemidatrojan

Malware Config

Signatures

  • Detects executables packed with Themida 2 IoCs
  • Detects executables packed with VMProtect. 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 32 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 7 IoCs
    installer
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3244
    • C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe
        "C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe" -i c
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4400
        • C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe
          "C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe" /s
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:576
          • C:\Program Files\KeySharp\SetupProgram.exe
            "C:\Program Files\KeySharp\SetupProgram.exe" -i c u
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Modifies trusted root certificate store through registry
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4660
        • C:\Program Files\Raonsecure\KeySharp nxWireless Cert\raon_touchenex_Install-x64.exe
          "C:\Program Files\Raonsecure\KeySharp nxWireless Cert\raon_touchenex_Install-x64.exe" /S
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4940
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32.exe" "C:\Program Files\RaonSecure\bridge\CrossEX\touchenex\1.0.1.1243\CrossEXProtocol.dll" /S
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Windows\system32\regsvr32.exe
              "C:\Program Files\RaonSecure\bridge\CrossEX\touchenex\1.0.1.1243\CrossEXProtocol.dll" /S
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:2496
    • C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1700
      • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe
          "C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe" -i c
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe
            "C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe" /s
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:236
            • C:\Program Files\KeySharp\SetupProgram.exe
              "C:\Program Files\KeySharp\SetupProgram.exe" -i c u
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2324
  • C:\ProgramData\Synaptics\Synaptics.exe
    C:\ProgramData\Synaptics\Synaptics.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\SysWOW64\._cache_Synaptics.exe
      "C:\Windows\system32\._cache_Synaptics.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1584
      • C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe
        "C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe" -i c
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2500
        • C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe
          "C:\Program Files\Raonsecure\KeySharp nxWireless Cert\KSCertRelay_Installer_64bit.exe" /s
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Program Files\KeySharp\SetupProgram.exe
            "C:\Program Files\KeySharp\SetupProgram.exe" -i c u
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:868
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1236

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CKSetup32.exe
        • Path C:\Program Files\KeySharp\CKSetup32.exe
        • Size 2.7MB
        • SHA256 7d0f19f350f640bb519bd8c9b5a70369e05c35a104fe0f0cabdc1423bfe8038d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CrossEXClient_64.sig
        • Path C:\Program Files\KeySharp\CrossEXClient_64.sig
        • Size 44B
        • SHA256 7f782c00d63a9d897b5f906976b4cf88a0e5e1d2e4437866f63cda13e44c5040
        • MD5 SHA1 SHA512
        Submit Download

        KSCertRelay.exe
        • Path C:\Program Files\KeySharp\KSCertRelay.exe
        • Size 2.7MB
        • SHA256 0c7c4857dd292dc1febe51c32c16642ad0b2e52967b3643ff5fd37f97892c752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCertRelayDll.dll
        • Path C:\Program Files\KeySharp\KSCertRelayDll.dll
        • Size 187KB
        • SHA256 9dbe1724302a3b6f6aad09bb807030a4e3a56bd35e66710e0d44a01dde32d45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCertRelayMain.dll
        • Path C:\Program Files\KeySharp\KSCertRelayMain.dll
        • Size 166KB
        • SHA256 45d911133c02700fd68bf0109c2507d4d27a7f26611166101f0d72beccc46d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCertRelayQR.exe
        • Path C:\Program Files\KeySharp\KSCertRelayQR.exe
        • Size 2.6MB
        • SHA256 d46198497299b2ee41f03afbfe6860c9ad50ddd39a8b81a662dae8ca33218af2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCertRelay_Installer_64bit.exe
        • Path C:\Program Files\KeySharp\KSCertRelay_Installer_64bit.exe
        • Size 7.2MB
        • SHA256 59f7a34466ae7246403a83a5d930b18466c22d4ad154fcb5343ff91889c1a76d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCertRelay_NXInstaller_64bit.exe
        • Path C:\Program Files\KeySharp\KSCertRelay_NXInstaller_64bit.exe
        • Size 546KB
        • SHA256 a8093da9b588e6f10fd8112076c4f3551d178291d430a2b123b69eed561ace87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KSCrc2ActiveX.dll
        • Path C:\Program Files\KeySharp\KSCrc2ActiveX.dll
        • Size 236KB
        • SHA256 1d742f4ac9f9e7b1574c9c4f07c03ba81cd6672c1b09ff3d38dac93ee2cdd3c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KeySharpCrypto.dll
        • Path C:\Program Files\KeySharp\KeySharpCrypto.dll
        • Size 281KB
        • SHA256 2d243a828d6f15ecdd1c9d73dec758fc4c58280fe9f71c766f363836a28b14cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QRCodeEncodeDLL.dll
        • Path C:\Program Files\KeySharp\QRCodeEncodeDLL.dll
        • Size 120KB
        • SHA256 21259409c439115cccfb2189d38453e27a2cf2b16f6f1d09f2c70ac0de6c009b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SetupProgram.exe
        • Path C:\Program Files\KeySharp\SetupProgram.exe
        • Size 143KB
        • SHA256 1f8eb79611d2685bdd2e6b0feb5af0c13fa57d7149341f5fc88f433bb727f9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TouchEnKeyCS.dll
        • Path C:\Program Files\KeySharp\TouchEnKeyCS.dll
        • Size 697KB
        • SHA256 8cca77cbaa290f57cd8470abd7771d6f175c41be001f124bac452aad884fd47d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rca_digicert_root.cer
        • Path C:\Program Files\KeySharp\_rca_digicert_root.cer
        • Size 955B
        • SHA256 3e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _rca_globalsign_root.cer
        • Path C:\Program Files\KeySharp\_rca_globalsign_root.cer
        • Size 889B
        • SHA256 ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _rca_thawte_root.cer
        • Path C:\Program Files\KeySharp\_rca_thawte_root.cer
        • Size 1KB
        • SHA256 8d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _rca_thawte_time.cer
        • Path C:\Program Files\KeySharp\_rca_thawte_time.cer
        • Size 677B
        • SHA256 6b6c1e01f590f5afc5fcf85cd0b9396884048659fc2c6d1170d68b045216c3fd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _rca_verisign_class.cer
        • Path C:\Program Files\KeySharp\_rca_verisign_class.cer
        • Size 1KB
        • SHA256 9acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _rca_verisign_root.cer
        • Path C:\Program Files\KeySharp\_rca_verisign_root.cer
        • Size 1KB
        • SHA256 2399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ca.der
        • Path C:\Program Files\KeySharp\ca.der
        • Size 814B
        • SHA256 22e99254341d686914af6fb41f23323f4f2effadbcf2777f25447b82453a5439
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        certadm.dll
        • Path C:\Program Files\KeySharp\certadm.dll
        • Size 83KB
        • SHA256 bbba87bf62e8bdc11602f2a95712e5fe3fb1edbbcdeb28cbdcf191aeab286b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        certutil.exe
        • Path C:\Program Files\KeySharp\certutil.exe
        • Size 556KB
        • SHA256 75ddab1826f220eb36a9eea9cf8533c94c19bac89d961380f3a418f6eedb2b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crc2String_eng.dll
        • Path C:\Program Files\KeySharp\crc2String_eng.dll
        • Size 28KB
        • SHA256 a2c1eedd6c43610d1ff347976d9f61c11e219d30bfe2e55e5da3c5d15315dffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        crc2String_kor.dll
        • Path C:\Program Files\KeySharp\crc2String_kor.dll
        • Size 24KB
        • SHA256 e6cd6fefb65898517e7f80295c7a03dde0b401b242a108faba1ec1ea41f4679f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        npKSCertRelay.dll
        • Path C:\Program Files\KeySharp\npKSCertRelay.dll
        • Size 125KB
        • SHA256 7f3842a2505f20df0fbf54293842115b6d41cf5464357cfb7de3f019bb40d346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        raon_touchenex_Install-x64.exe
        • Path C:\Program Files\KeySharp\raon_touchenex_Install-x64.exe
        • Size 765KB
        • SHA256 ce97a1e1ce09ec5b4b34e054103b724415aa635e4696315cf3bf2e2928c82dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Synaptics.exe
        • Path C:\ProgramData\Synaptics\Synaptics.exe
        • Size 12.8MB
        • SHA256 6227f7a8286f897ecbfa570340b6cd22914f540606fa051e28d92b4a23abed29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ._cache_2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
        • Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-05-28_58c56f1da856552ded8d00f728b6ed13_amadey_cloudeye_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
        • Size 8.1MB
        • SHA256 81e58dc3b01ebc1bb791cb6c029851657257f4933df1320dda2f18019df0d45f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WoNHAbgu.xlsm
        • Path C:\Users\Admin\AppData\Local\Temp\WoNHAbgu.xlsm
        • Size 17KB
        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nso5B99.tmp\System.dll
        • Size 10KB
        • SHA256 4ca5bf1beb4b802914c4d3e2f37861f6ba5ecf969cfeadf5855edf58f647a721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1236-305-0x00007FF8C6F30000-0x00007FF8C6F40000-memory.dmp
        Download

        memory/1236-304-0x00007FF8C6F30000-0x00007FF8C6F40000-memory.dmp
        Download

        memory/1236-303-0x00007FF8C6F30000-0x00007FF8C6F40000-memory.dmp
        Download

        memory/1236-309-0x00007FF8C6F30000-0x00007FF8C6F40000-memory.dmp
        Download

        memory/1236-302-0x00007FF8C6F30000-0x00007FF8C6F40000-memory.dmp
        Download

        memory/1236-318-0x00007FF8C4D10000-0x00007FF8C4D20000-memory.dmp
        Download

        memory/1236-319-0x00007FF8C4D10000-0x00007FF8C4D20000-memory.dmp
        Download

        memory/1700-136-0x0000000001270000-0x0000000001271000-memory.dmp
        Download

        memory/2440-141-0x00000000011F0000-0x00000000011F1000-memory.dmp
        Download

        memory/3244-1-0x0000000002F60000-0x0000000002F61000-memory.dmp
        Download

        memory/3244-0-0x0000000002F20000-0x0000000002F21000-memory.dmp
        Download