Analysis
- max time kernel
122s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
- Size 912KB
- Sample260723-srdcdafj31
- SHA256 5ee2a76e2bd9e0ffb6131848de57d5606946e8a2388b36a14e822fe452af7afe
- MD5 26088d38fb8007b80c681f2315a74c55
- SHA1 5e2e37b88f8889ea394d9716aa1420659b5c43df
- SHA512 8472c46301f312cdb2e8d1bf6ca44aa38c070dbc6db06b1b33087f68e8ad221942f884f20eadfe2c5e5f91d1939d21fbdbbf97a70de8ab4d38cbebba20f419f6
- SSDEEP 12288:awCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888d:6NzCtUpQ9WWPBSSRMTEpXNPqSKr
- TLSH T161156B1AB2D7143BC03606BD492752649C3B7D202A96585A5EFCFF4C0F392A33D36E96
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 3 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/4628-19-0x0000000000230000-0x0000000000239000-memory.dmp family_bdaejec_backdoor behavioral1/memory/4628-37-0x0000000000230000-0x0000000000239000-memory.dmp family_bdaejec_backdoor behavioral1/memory/4628-441-0x0000000000230000-0x0000000000239000-memory.dmp family_bdaejec_backdoor - Detects Renamer worm. 1 IoCs
Renamer aka Grename is worm written in Delphi.
resource yara_rule behavioral1/files/0x000700000002463e-45.dat family_renamer - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Detects executables packed with ASPack 4 IoCs
resource yara_rule behavioral1/files/0x00110000000231f3-9.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4628-19-0x0000000000230000-0x0000000000239000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4628-37-0x0000000000230000-0x0000000000239000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4628-441-0x0000000000230000-0x0000000000239000-memory.dmp INDICATOR_EXE_Packed_ASPack - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 38 IoCs
resource yara_rule behavioral1/memory/4580-15-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-17-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-20-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-21-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-16-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-8-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-7-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-6-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-18-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-5-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-33-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-34-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-35-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-43-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-44-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-189-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-407-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-442-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-443-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-447-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-449-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-452-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-454-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-463-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-475-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-478-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-481-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-486-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-488-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-495-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-497-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-496-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-499-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-502-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-507-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-508-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-510-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4580-529-0x0000000002460000-0x000000000351A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 42 IoCs
resource yara_rule behavioral1/memory/4580-15-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-17-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-20-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-21-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-32-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral1/memory/4580-16-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-8-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-7-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-6-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-18-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-5-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-33-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-34-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-35-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-36-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral1/memory/4580-43-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-44-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-189-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-362-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral1/memory/4580-407-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-440-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral1/memory/4580-442-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-443-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-447-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-449-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-452-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-454-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-463-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-475-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-478-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-481-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-486-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-488-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-495-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-497-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-496-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-499-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-502-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-507-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-508-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-510-0x0000000002460000-0x000000000351A000-memory.dmp UPX behavioral1/memory/4580-529-0x0000000002460000-0x000000000351A000-memory.dmp UPX -
resource yara_rule behavioral1/files/0x00110000000231f3-9.dat aspack_v212_v242 - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation wQWgLs.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Executes dropped EXE 1 IoCs
pid Process 4628 wQWgLs.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\Q: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\V: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\W: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\N: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\O: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\P: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\S: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\T: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\U: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\Z: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\H: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\K: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\L: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\M: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\Y: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\E: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\G: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\I: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\R: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\X: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification F:\autorun.inf 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe -
resource yara_rule behavioral1/memory/4580-15-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-17-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-20-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-21-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-16-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-8-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-7-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-6-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-18-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-5-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-33-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-34-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-35-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-43-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-44-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-189-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-407-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-442-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-443-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-447-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-449-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-452-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-454-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-463-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-475-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-478-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-481-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-486-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-488-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-495-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-497-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-496-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-499-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-502-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-507-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-508-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-510-0x0000000002460000-0x000000000351A000-memory.dmp upx behavioral1/memory/4580-529-0x0000000002460000-0x000000000351A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe wQWgLs.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe wQWgLs.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\vSQLDumper.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe wQWgLs.exe File created C:\Program Files\7-Zip\v7zFM.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe wQWgLs.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe wQWgLs.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\ieinstal.exe.mui 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjdeps.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe wQWgLs.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\ieinstal.exe.mui 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe wQWgLs.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\vjar.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe wQWgLs.exe File created C:\Program Files\7-Zip\v7z.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\vIntegrator.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe wQWgLs.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe wQWgLs.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\velevation_service.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\RCX6A24.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\vjabswitch.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe wQWgLs.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe wQWgLs.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vAppSharingHookController.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX70F5.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe wQWgLs.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe wQWgLs.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\vcreatedump.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe wQWgLs.exe File created C:\Program Files\Java\jdk-1.8\bin\vjavac.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe wQWgLs.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe wQWgLs.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX6BBD.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjava.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE wQWgLs.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\RCX7117.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jre-1.8\bin\vjabswitch.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\vaccicons.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe wQWgLs.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e582a76 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Windows\SYSTEM.INI 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Windows\bfsvc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2560 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wQWgLs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4628 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 85 PID 4580 wrote to memory of 780 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 8 PID 4580 wrote to memory of 784 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 9 PID 4580 wrote to memory of 516 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 14 PID 4580 wrote to memory of 2760 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 46 PID 4580 wrote to memory of 2776 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 47 PID 4580 wrote to memory of 2040 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 53 PID 4580 wrote to memory of 3276 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 56 PID 4580 wrote to memory of 3424 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 4580 wrote to memory of 3612 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 58 PID 4580 wrote to memory of 3700 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 4580 wrote to memory of 3768 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 4580 wrote to memory of 3848 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 4580 wrote to memory of 4016 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 62 PID 4580 wrote to memory of 4988 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 4580 wrote to memory of 2712 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 78 PID 4580 wrote to memory of 4964 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 4580 wrote to memory of 4628 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 85 PID 4580 wrote to memory of 4628 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 85 PID 4580 wrote to memory of 780 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 8 PID 4580 wrote to memory of 784 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 9 PID 4580 wrote to memory of 516 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 14 PID 4580 wrote to memory of 2760 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 46 PID 4580 wrote to memory of 2776 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 47 PID 4580 wrote to memory of 2040 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 53 PID 4580 wrote to memory of 3276 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 56 PID 4580 wrote to memory of 3424 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 4580 wrote to memory of 3612 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 58 PID 4580 wrote to memory of 3700 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 4580 wrote to memory of 3768 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 4580 wrote to memory of 3848 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 4580 wrote to memory of 4016 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 62 PID 4580 wrote to memory of 4988 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 4580 wrote to memory of 2712 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 78 PID 4580 wrote to memory of 4964 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 4580 wrote to memory of 780 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 8 PID 4580 wrote to memory of 784 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 9 PID 4580 wrote to memory of 516 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 14 PID 4580 wrote to memory of 2760 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 46 PID 4580 wrote to memory of 2776 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 47 PID 4580 wrote to memory of 2040 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 53 PID 4580 wrote to memory of 3276 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 56 PID 4580 wrote to memory of 3424 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 4580 wrote to memory of 3612 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 58 PID 4580 wrote to memory of 3700 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 4580 wrote to memory of 3768 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 4580 wrote to memory of 3848 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 4580 wrote to memory of 4016 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 62 PID 4580 wrote to memory of 4988 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 4580 wrote to memory of 2712 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 78 PID 4580 wrote to memory of 4964 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 4580 wrote to memory of 780 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 8 PID 4580 wrote to memory of 784 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 9 PID 4580 wrote to memory of 516 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 14 PID 4580 wrote to memory of 2760 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 46 PID 4580 wrote to memory of 2776 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 47 PID 4580 wrote to memory of 2040 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 53 PID 4580 wrote to memory of 3276 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 56 PID 4580 wrote to memory of 3424 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 4580 wrote to memory of 3612 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 58 PID 4580 wrote to memory of 3700 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 4580 wrote to memory of 3768 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 4580 wrote to memory of 3848 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 4580 wrote to memory of 4016 4580 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 62 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:516
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2776
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2040
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\wQWgLs.exeC:\Users\Admin\AppData\Local\Temp\wQWgLs.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2dfe7c38.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2560
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3424
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3612
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3700
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3768
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3848
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4016
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4988
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2712
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4964
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:2556
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 31KB
- SHA256 56bbe47722b23b40e2471015e3161040252b177f58cec2b4b55b0f5f9fdb0897
- MD5 be17af3b68e25ca13fe0d00a5260eda0
- SHA1 08443736fe6cde8a631510cf24eacfc2adfe4dcb
- SHA512 a51f4b0c0801ab36cf49639fa22258b6ef95b452f571222f8b080f0d68bc21ff2532c55524d47c20d4c034451204b5fced52b7e064930f35bd1471e567945955
- SSDEEP 768:6WQ3655Kv1KjqY1MNHYRQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHYWGCq2iW7z
- TLSH T142E28D53CF9054F6E7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E862257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\vjavaws.ico
- Size 4KB
- SHA256 611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5
- MD5 38b41d03e9dfcbbd08210c5f0b50ba71
- SHA1 2fbfde75ce9fe8423d8e7720bf7408cedcb57a70
- SHA512 ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9
- SSDEEP 96:GxZnQuikS0jj8KJy9QhT8PB5CXMaTFgL3n:GxZQuiQjruQ65wXMWA
- TLSH T10391ABB2F18998D5DC566D73453EAC7250E37EAD89E68A0D109F73158AF338110E6E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\vIntegratedOffice.ico
- Size 4KB
- SHA256 a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c
- MD5 3ea9bcbc01e1a652de5a6fc291a66d1a
- SHA1 aee490d53ee201879dff37503a0796c77642a792
- SHA512 7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501
- SSDEEP 48:r2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:r6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
- TLSH T12291553EA718B8B0F94E6DB1236FC064501E7504141BCDA6B1A9FCB07F92CEA40147CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\vmisc.ico
- Size 4KB
- SHA256 3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05
- MD5 fc27f73816c9f640d800cdc1c9294751
- SHA1 e6c3d8835d1de4e9606e5588e741cd1be27398f6
- SHA512 9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4
- SSDEEP 12:GFXAOAO9XAkXRABEXAOAOANXAO6qOyvOyYvOy44o4v44PQ91pnSqu:GiB7GABbBBa1qlvlYvl44o4v44PQP/u
- TLSH T171916492593E9DF8C1550930C99FCFA14E341C1744505542E7F2AECF9EB1B50F61B668
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7EOZKXVE\k2[1].rar
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\06DF068B.exe
- Size 1B
- SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
- MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
- SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
- SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\2dfe7c38.bat
- Size 187B
- SHA256 bdb0c21d11add72724e448f580a9fa73fc27564f2016344a5165857bce582761
- MD5 fc08678e2e9d00d7b01879e94b88c85d
- SHA1 e97a8d9c84c603e40b345d7cb79676b9ae9dffa1
- SHA512 56e34c796fdc59d3b7e96dcd5ebd9cfda0efb729660b5db56c6ac15c9306200f02d2afdcacee885711c3fb05fc161733a399e0f4afbeba7ed7ea50df8d595089
- TLSH T1C3C0120282C6CA9E1558516776E6614CD06508587B9D2F115B20C45C61E6C0DB7C7B15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wQWgLs.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Paint.exe
- Size 841KB
- SHA256 48706f46cd2f477d11257c9718fae732bc492da05a0de07db4bd32960a34cf32
- MD5 ba4ca0507dfb24c09904ffb9cee1872d
- SHA1 0c13be48913dc78b31a1fa457735e5c4a73f7e2a
- SHA512 24c1dd44649e050aec58e85ca57f8155ac41be1cf56662de05c851aefda85dbc28a8e21af578e98a7c8687d21118a61f5e3dee38258df091a5aeff46ffc8adf7
- SSDEEP 12288:twCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888X:hNzCtUpQ9WWPBSSRMTEpXN
- TLSH T12D055A1AB2D7143BC03706BD492752645C3B7E202A96585A5EFCBF4C0F392A33D36E96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ivht.exe
- Size 97KB
- SHA256 1d32ffa3050f8de9b4c9315818372a70536ba55988d249308a1639c87ae6d989
- MD5 eaf5debbc13d34a00154af0bf6ebe347
- SHA1 f5b24d0c009aca01bb06c838561ed5c34d80066c
- SHA512 bce6946e97ef4a72697d19218e3007d46a1fedf5d7fb1c11f0cbeab606ceb7295f0d6c7be05224de07cd62fef4e20385eea6180d10c004b8c7b7842d47ca42e7
- SSDEEP 3072:BtC6+imm7/MZ4NF+pGxwQ3eruxx4ckMz:BUiZ7/MZcFPeu4c/
- TLSH T1CBA31265744E041EF1DD657300B382B293B9DCB8436E20AA6739A77F1D88F756BC814A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 102B
- SHA256 94e323bd9071db7369ade16f45454e7a0dbfb6a39efddc1234c4719d1f7ee4c2
- MD5 5513829683bff23161ca7d8595c25c72
- SHA1 9961b65bbd3bac109dddd3a161fc30650e8a7096
- SHA512 308c84446106cda0a71e37b0de46aaf4b7361f9ddcc3c4c29f8e87da8acb606525dce8a42caf9d74e708c56b31c524f9535a2f5f4757c6c357401da1c495ddb6
- TLSH T14EB09226D649C1051E8AB608D0088139F46DA31E01B0A2030AA8F89AC461148CB30862
- MD5 SHA1 SHA512 TLSH