Overview

overview

4

Static

static

1

2026-07-08...os.exe

windows10-2004-x64

3

2026-07-08...os.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_58426abde1d2e61eb367b2916cb9e746_darkgate_elex_glassworm_maze_remcos.exe
  • Size 2.3MB
  • Sample260708-2dr32saz3t
  • SHA256 21b1a26b626f3021cb096041017c1f352b1794d148b232e2a7e31b3413cf2ed1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
adwaredefense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_58426abde1d2e61eb367b2916cb9e746_darkgate_elex_glassworm_maze_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_58426abde1d2e61eb367b2916cb9e746_darkgate_elex_glassworm_maze_remcos.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4788

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 2KB
        • SHA256 f01ec8d41d6a4ec11f8c2d830355051afcc48196a2795654cd6471f2f5406919
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 2KB
        • SHA256 0206137444e7b5d540ed182843ecc7b9899add20c34fbd42cb48fc1a8b29566d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 3KB
        • SHA256 74156caffcccbd27e1324a4a6b443274e8aa63b20031cd82ef407acc871c9b81
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsWAE.log
        • Path C:\Users\Admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.log
        • Size 4KB
        • SHA256 b62928461e8154dac273aa7adece4549b0b088edca666cd8d3ce48ede8273261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 1KB
        • SHA256 651bc6f321ed0fcb4343c9775444656910ccc83007223c928dd0facae409f47e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 4KB
        • SHA256 5d67523e476239c583cf6a3e1fcd69bd54fe6fe61b6c8b97085171fe7b2a6ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 5KB
        • SHA256 b26c28cbbb42a3baf5edbca1f10f6e75c0ea3e67fca592464b5bab1806e8e46f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsduilib.log
        • Path C:\Users\Admin\AppData\Local\Temp\wsduilib.log
        • Size 6KB
        • SHA256 87e64b6e40aeca296ebbb7f843a9348f92f9ea3560bc4ea6124ff8d0b80f5f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download