Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
19/07/2026, 21:12
General
- Target 2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
- Size 605KB
- Sample260719-z2d5zsfv21
- SHA256 d4e1ceeaa6d03e46db31caec111f44df8e5b0b68d68ea250bdd55ed91c8922e2
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 58 IoCs
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_c953cca8b6927c2cd730886dfafdf710_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"5⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 4286⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 5086⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 4925⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 4925⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 5484⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 5484⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 4683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 4683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2500 -ip 25001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2500 -ip 25001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4808 -ip 48081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4808 -ip 48081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4132 -ip 41321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1156 -ip 11561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1156 -ip 11561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3108 -ip 31081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3108 -ip 31081⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RCX47F7.tmp
RCX4990.tmp
RCX5216.tmp
RCX5227.tmp
RCX5D12.tmp
pUc389A.tmp
pUc38AD.tmp
pUc47D3.tmp
pUc4924.tmp
pUc49A0.tmp
pUc49B3.tmp
pUc49E8.tmp
pUc4EB3.tmp
pUc4EC5.tmp
pUc4F0D.tmp
pUc4F1F.tmp
pUc4F64.tmp
pUc4FB5.tmp
pUc4FD7.tmp
pUc506A.tmp
pUc50AE.tmp
pUc50D1.tmp
pUc50F3.tmp
pUc5115.tmp
memory/1156-364-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/2500-136-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/3108-381-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/4132-340-0x0000000000400000-0x00000000004A1000-memory.dmp
memory/4808-295-0x0000000000400000-0x00000000004A1000-memory.dmp