74d159e0a6f7563436c41d1a2f80ac6977ebb0cb2d6d1d37755a4fc39d33711b

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_be9d068f41c22fc5d98c5135a1c4119e_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 2.4MB
Sample260715-t5bldact6v
SHA256 74d159e0a6f7563436c41d1a2f80ac6977ebb0cb2d6d1d37755a4fc39d33711b
MD5 be9d068f41c22fc5d98c5135a1c4119e
SHA1 76b586ec0e4487cbe78b70edc0fa9155d8d30a05
SHA512 8b1fbbaed07ddda2298b48cbb2e06beb03a3e73798680fe5928ff67c7ecade89fe329d10162fa75f846d30631b89cf5cd79c5e16dd2318d3d51c51c7f2404efc
SSDEEP 24576:LV7uNRjr4/xD1LqLZS6NaiSHiLHgZpJEIaewsAj:LV7uNRX+D1LQcHiLHkJELlj
TLSH
T14CC56B2FED6C9D61C16F3D304E25D3DD52287D208A027986AED47E8DEAB1FC0792D522
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3864-0-0x0000000000400000-0x000000000059C000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2332	3864	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_be9d068f41c22fc5d98c5135a1c4119e_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_be9d068f41c22fc5d98c5135a1c4119e_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_be9d068f41c22fc5d98c5135a1c4119e_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 276
  2⤵
  - Program crash
  PID:2332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3864 -ip 3864
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3864-0-0x0000000000400000-0x000000000059C000-memory.dmp

Download