d64cf1388a9ee6c5f0ab853271cda76748777f2c9246ad51e49c96db6e14d457

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 411KB
Sample260708-csbl6sat3p
SHA256 d64cf1388a9ee6c5f0ab853271cda76748777f2c9246ad51e49c96db6e14d457
MD5 b4f53ca5c1cbbdbe437760415e6bb968
SHA1 b2d5fba25a6c52d23d558f1b9b1b5621cc07ff92
SHA512 d86e296be202b6ce91dc0c8a9e16ba1b4dbef5e44fbcf3704b594cf0cafa45065c6ba1e3b06f88a613e1cdb398b70f8a8958844fcd21b2c597b419c7cc8b78e1
SSDEEP 6144:JUgYWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjRMt:8AwSfxL/2Dc3jDLLmt0LDQewsAjR0
TLSH
T1A5946B31FA70D432C2BB0DB51B25D706683DBA204F611AC3F3E89E9D59742D2673AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5868	temp0a1.exe

Executes dropped EXE 4 IoCs

pid	Process
5868	temp0a1.exe
1532	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
4728	exeexe.exe
1928	temp0a1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\exeexe.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\G:	temp0a1.exe
File opened (read-only)	\??\J:	temp0a1.exe
File opened (read-only)	\??\K:	temp0a1.exe
File opened (read-only)	\??\T:	temp0a1.exe
File opened (read-only)	\??\Z:	temp0a1.exe
File opened (read-only)	\??\H:	temp0a1.exe
File opened (read-only)	\??\P:	temp0a1.exe
File opened (read-only)	\??\R:	temp0a1.exe
File opened (read-only)	\??\U:	temp0a1.exe
File opened (read-only)	\??\V:	temp0a1.exe
File opened (read-only)	\??\X:	temp0a1.exe
File opened (read-only)	\??\L:	temp0a1.exe
File opened (read-only)	\??\M:	temp0a1.exe
File opened (read-only)	\??\O:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\D:	temp0a1.exe
File opened (read-only)	\??\Q:	temp0a1.exe
File opened (read-only)	\??\Y:	temp0a1.exe
File opened (read-only)	\??\I:	temp0a1.exe
File opened (read-only)	\??\N:	temp0a1.exe
File opened (read-only)	\??\S:	temp0a1.exe
File opened (read-only)	\??\W:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bb.ico	temp0a1.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	temp0a1.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\file0a0.dat	exeexe.exe
File created	C:\Windows\exeexe.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Windows\file0a0.dat	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
File opened for modification	C:\Windows\exeexe.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	exeexe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exeexe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1176	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
1176	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
4728	exeexe.exe
4728	exeexe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 5868	1176	2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe	88
PID 5868 wrote to memory of 1532	5868	temp0a1.exe	89
PID 4728 wrote to memory of 1928	4728	exeexe.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Users\Admin\AppData\Local\Temp\2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1532

C:\Windows\exeexe.exe
C:\Windows\exeexe.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.2MB
SHA256 1b43bd6202fd8280c6436429c1b2ce56aee3892d606dc23d1e0cd33776162049
MD5 45944d9a109cbdbde11230e25084124c
SHA1 27928740fc56aad9059553d14051617b92f888a7
SHA512 186421ff6bc0abde925ee2043b0aa0a7c0a0eaf05b0cc79ccd4c196133b8ec726b9432f934238187d9103b43ae67c3fa437fb6516f1870f9139003af112c92e6
SSDEEP 49152:VSQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3Tu:VSQvGAdlCEL8c/bRNw5CF
TLSH
T144165C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-08_b4f53ca5c1cbbdbe437760415e6bb968_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 359KB
SHA256 84d4c479221646130ed559a78fb278996fbc060cf87debf6e8bd2c270a7d70f2
MD5 ac6978d0fef8f6f2f07051473d188f02
SHA1 e50da923c96e44b0d7987eb1e6a7940a05b511b4
SHA512 95147a5ff79642e007d718d095cfefb424f7bd40dce15f4810f27ae1d52c21f329f9649fba9e654e3215747cb1fa6f8534f0a0d42c68bd75374530ad059d6ab9
SSDEEP 6144:tWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjRMX:tAwSfxL/2Dc3jDLLmt0LDQewsAjRE
TLSH
T101746B31FE74E032C7BB0DB21B36C716183DBA604B511AC3E3A89E9D59702D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.ico

Path C:\Windows\SysWOW64\bb.ico
Size 4KB
SHA256 823cbf89390733bd09d5541839786670d748064e50ff235928abd9e2433192b7
MD5 84a8ab049bb249ce1b1e25d5648571a9
SHA1 66b48c0e63f542b74a5b003af9660222c1d0f324
SHA512 8ce3b7fa9917ee0164b3a09920aaa1ec6806159aab184e3fbb15fc58134c64957811eded9ad3d459c0c1a257aee3129473136d1800f5d89bc9adc5a43a4b6c64
SSDEEP 48:z2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:z6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T19C91553EA718B8B0F98E6DB1236FC064505E7504151BCDA6B1A9FCB07F92CEA40143CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exeexe.exe

Path C:\Windows\exeexe.exe
Size 51KB
SHA256 8b10a750a55089e24c58cbd8127488a79109f35eef1e2afe1d85627f974b592e
MD5 e7476e9d2b3f95a923448d424750d1f7
SHA1 e17156bbc0172348b9c2c976f071a29c903bd8b6
SHA512 368fbde70d37d88d55c947e30e108b074d7b1e3f9856f2c07eb6d1ad3a974fd836286b30862103f6bb430229fbb49e5ab54e67a92db94a9a381b0c696c741bca
SSDEEP 768:YwJvvqaxRyEtyZmC9Lm09Pv2pMJ0+s4t9cpO5vAjXFBS3Q70PcLHQitRr1DJSBOE:J3qaxRyEk9LmQuyPt9cgY4PcLH7nkb
TLSH
T119336B53FA808576E055DABC9C18D284BE3C7A30AD3990A6BBDD1FCCDF2D1D0542DA92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 133B
SHA256 a3e8ecae2b2ec38a89a61bb299f40c306e23008baff2355aebffa76dc71e2915
MD5 215c84acef3e90fddae4a4eee7ca7729
SHA1 94b701b381f6c51d2e64b7de48d493b555ce406a
SHA512 1f87299603407cffd3d6fe56ffb5216822c48b1b08f53cfb91e16a68ed556919a4ecf79b56c6ee85df57c784de281d68b368edda9df0915911b0eeec5897313b
TLSH
T1CCC02B03815FCC010529F00383A32D45C0F0DA4F25871711B31CC44C25E700FE4CA384
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 21B
SHA256 fa7ae405b3a60a5ea79a3ae6d82c47d9050896717efe6a67a37bc743d3437a68
MD5 120d9d9fdb61f1fd227c27d8aa66de63
SHA1 5fb28b337d52b0e26b33df432e0c56f769082832
SHA512 c0025f852b299efafcdfa4605e799ebcac685a7bd1e2df5234c423a3832af4ea7e400048a121a6813f41a4ce77d07086a71a60a8031b0942a627bcfec201657c
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 411KB
SHA256 d64cf1388a9ee6c5f0ab853271cda76748777f2c9246ad51e49c96db6e14d457
MD5 b4f53ca5c1cbbdbe437760415e6bb968
SHA1 b2d5fba25a6c52d23d558f1b9b1b5621cc07ff92
SHA512 d86e296be202b6ce91dc0c8a9e16ba1b4dbef5e44fbcf3704b594cf0cafa45065c6ba1e3b06f88a613e1cdb398b70f8a8958844fcd21b2c597b419c7cc8b78e1
SSDEEP 6144:JUgYWhzr8SfxL/2Dc33C+U4tLsUL6mmt0fSoD78uLwsehNjRMt:8AwSfxL/2Dc3jDLLmt0LDQewsAjR0
TLSH
T1A5946B31FA70D432C2BB0DB51B25D706683DBA204F611AC3F3E89E9D59742D2673AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1176-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-23-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-17-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-18-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-19-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-20-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-21-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-22-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-16-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-24-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-31-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1928-55-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4728-14-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5868-11-0x0000000000400000-0x0000000000413000-memory.dmp

Download