Overview

overview

4

Static

static

3

2026-07-12...er.exe

windows10-2004-x64

4

2026-07-12...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 20:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_ce8e5011d3cb0d63f8486746279b75e9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
  • Size 594KB
  • Sample260712-y86cdagw2k
  • SHA256 266b9053bfa016d09c532d8fb2d23e9f7b757b6a4f16d4a5063547ba0d3e5669
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 13 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_ce8e5011d3cb0d63f8486746279b75e9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_ce8e5011d3cb0d63f8486746279b75e9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 496
      2⤵
      • Program crash
      PID:1220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 496
      2⤵
      • Program crash
      PID:4344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4744 -ip 4744
    1⤵
      PID:2172
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4744 -ip 4744
      1⤵
        PID:1336

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            RCX48DC.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RCX48DC.tmp
            • Size 1.2MB
            • SHA256 77b7f2d605aa9c10cc58b85f87ac74edeb2b7ea555c378e4f8c990f1d28d5a0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc48C7.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc48C7.tmp
            • Size 784KB
            • SHA256 4ddf4129772dc0da406d54e10ba8386c0e0a588bc665216b963ac0b2841c9fff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc48EC.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc48EC.tmp
            • Size 927KB
            • SHA256 fa2c7fbc66d3fca7040f701621f175390325c9dbf58e7f4e1ea6112a16b488ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc48FF.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc48FF.tmp
            • Size 249KB
            • SHA256 3e99fbdada65cc5528d663cc59e3180d7acdab70ed2f0486619fb8f87e87ca51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4921.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4921.tmp
            • Size 2.4MB
            • SHA256 70218cea33d5a6d2c67ee821bf58141e7652bb9fd91dd24f3eb22dbcb4fa4712
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4B37.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4B37.tmp
            • Size 516KB
            • SHA256 8819f2d502218347f6d12e16f5bfe506b726d7350b9b838a9f3aeccad8fc1bc4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4B4A.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4B4A.tmp
            • Size 282KB
            • SHA256 2afd5eb0908d5738ff51a024736ed689dcf5cb8b71fa775c9c6490838e0dd275
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4B5D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4B5D.tmp
            • Size 4.3MB
            • SHA256 eb4e8c2289fca4d875a9a126e34732c1fac6ca05897e087c938590bba378e8ef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4B6F.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4B6F.tmp
            • Size 594KB
            • SHA256 897ca030878884034e5b59987cd6b8ad756fb99fb1f9e50f6c813fc4ed5eb31f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc4BA1.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc4BA1.tmp
            • Size 23.7MB
            • SHA256 74c5356e8f6929367aecfae05e97604f9bc5f13ec161e8abef23edca08183f30
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4744-89-0x0000000000400000-0x000000000049F000-memory.dmp
            Download