Analysis
- max time kernel
149s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 18:28
General
- Target 2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
- Size 583KB
- Sample260715-w4jayabx3j
- SHA256 6c836eafffdec1242888036f50b21cbf2415e8113cc91a6dde64566f7391ba1b
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 59 IoCs
- Program crash 12 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"5⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_92712f5d63efafb5076a4892c565532f_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"6⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 4687⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 5127⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 4846⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 5086⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 5245⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 4965⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 4844⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 5324⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 4923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 4923⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3032 -ip 30321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2604 -ip 26041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2604 -ip 26041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1360 -ip 13601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1360 -ip 13601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3724 -ip 37241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 3724 -ip 37241⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RCX4BA7.tmp
RCX4BBA.tmp
RCX4E4D.tmp
pUc3DCA.tmp
pUc3F64.tmp
pUc3F86.tmp
pUc3FF0.tmp
pUc4012.tmp
pUc4025.tmp
pUc4079.tmp
pUc4415.tmp
pUc4437.tmp
pUc447C.tmp
pUc44DC.tmp
pUc450E.tmp
pUc45B1.tmp
pUc45F5.tmp
pUc4627.tmp
pUc4649.tmp
pUc465C.tmp
pUc468E.tmp
pUc46B0.tmp
pUc6B82.tmp
pUc6C11.tmp
memory/1360-373-0x0000000000400000-0x000000000049C000-memory.dmp
memory/2604-347-0x0000000000400000-0x000000000049C000-memory.dmp
memory/3032-323-0x0000000000400000-0x000000000049C000-memory.dmp
memory/3724-390-0x0000000000400000-0x000000000049C000-memory.dmp
memory/4132-285-0x0000000000400000-0x000000000049C000-memory.dmp
memory/4340-261-0x0000000000400000-0x000000000049C000-memory.dmp