Overview

overview

7

Static

static

3

2026-07-02...er.exe

windows10-2004-x64

7

2026-07-02...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/07/2026, 21:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-02_2cada858d82e82bffc85b12ec1458c06_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
  • Size 892KB
  • Sample260702-zypsbaez3v
  • SHA256 292bbe020f0eae97354be1437e53d0aa44623dd2dbeae307b5c500c29c174827
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 20 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-02_2cada858d82e82bffc85b12ec1458c06_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_2cada858d82e82bffc85b12ec1458c06_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\2026-07-02_2cada858d82e82bffc85b12ec1458c06_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-02_2cada858d82e82bffc85b12ec1458c06_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 472
        3⤵
        • Program crash
        PID:3428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 472
        3⤵
        • Program crash
        PID:5004
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 516
      2⤵
      • Program crash
      PID:1052
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 556
      2⤵
      • Program crash
      PID:1516
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4736 -ip 4736
    1⤵
      PID:5940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4736 -ip 4736
      1⤵
        PID:1000
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4988 -ip 4988
        1⤵
          PID:2804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4988 -ip 4988
          1⤵
            PID:2632

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                pUc5412.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5412.tmp
                • Size 1.1MB
                • SHA256 ef1e8efc825059280ed17523e707dfa7062b6e281d9e243a9034641c80878680
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5424.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5424.tmp
                • Size 1.5MB
                • SHA256 2113ad6cf2f35d7515060b219c72bce82c0ad4a0a9af40f88b640b29c5f8c046
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5437.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5437.tmp
                • Size 1.2MB
                • SHA256 2393c1fde80eceeef45105066a2f8e85baf50fa21cf44f5d4b1677989a08ea70
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5989.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5989.tmp
                • Size 547KB
                • SHA256 7b2c84dae75770c6e9be44d9ebf373eedaeeab577d48cb1294194311dc2ba59f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc59AB.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc59AB.tmp
                • Size 2.6MB
                • SHA256 aac9ce8e7db4c16e99bc7bbbcca18bf634e353cbc7ab54bf761d3f67d0ebbfb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc59BE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc59BE.tmp
                • Size 814KB
                • SHA256 91bde79ac3357bc04ebb74245558aa6345c2fd9312202d2eb1357ac8f0fa1706
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc59D1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc59D1.tmp
                • Size 580KB
                • SHA256 16be18a96d84be0660c11e0604553dacdb7615409d404b64304154c6274a8fff
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc59F3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc59F3.tmp
                • Size 4.6MB
                • SHA256 06d886b0e09a40330c17c89c6c853ef93b2e727f31165dae020610157b4fa625
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc66B8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc66B8.tmp
                • Size 892KB
                • SHA256 292bbe020f0eae97354be1437e53d0aa44623dd2dbeae307b5c500c29c174827
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc6718.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc6718.tmp
                • Size 24.0MB
                • SHA256 6fe0762ed165fdb49aacd276a40382cd6617bf643f7460892e1fb2b7e0f8e3ce
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc81F0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc81F0.tmp
                • Size 1.1MB
                • SHA256 cb6bc08740e7376f2c762239113386d91c4e9c76316173b540d3d67fb832e3be
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc8202.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc8202.tmp
                • Size 790KB
                • SHA256 a083170f715f379366994d8df35a2fa8cb756444f7f8defa4989a013671867f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc90DA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc90DA.tmp
                • Size 629KB
                • SHA256 0084b677698a5c78efabccf1b1d351a2167a13cc17f4cdfcd76a8cb804d9ac36
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4736-94-0x0000000000400000-0x00000000004E9000-memory.dmp
                Download

                memory/4736-128-0x0000000000400000-0x00000000004E9000-memory.dmp
                Download

                memory/4988-131-0x0000000000400000-0x00000000004E9000-memory.dmp
                Download