Analysis
- max time kernel
122s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
29 signatures
150 seconds
General
- Target 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
- Size 912KB
- Sample260723-srdcdafj31
- SHA256 5ee2a76e2bd9e0ffb6131848de57d5606946e8a2388b36a14e822fe452af7afe
- MD5 26088d38fb8007b80c681f2315a74c55
- SHA1 5e2e37b88f8889ea394d9716aa1420659b5c43df
- SHA512 8472c46301f312cdb2e8d1bf6ca44aa38c070dbc6db06b1b33087f68e8ad221942f884f20eadfe2c5e5f91d1939d21fbdbbf97a70de8ab4d38cbebba20f419f6
- SSDEEP 12288:awCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888d:6NzCtUpQ9WWPBSSRMTEpXNPqSKr
- TLSH T161156B1AB2D7143BC03606BD492752649C3B7D202A96585A5EFCFF4C0F392A33D36E96
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Extracted
Family
-
bdaejec
C2
-
ddos.dnsnb8.net
Signatures
- Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/4732-43-0x0000000000AF0000-0x0000000000AF9000-memory.dmp family_bdaejec_backdoor - Detects Renamer worm. 1 IoCs
Renamer aka Grename is worm written in Delphi.
resource yara_rule behavioral2/files/0x000d00000001c4c4-56.dat family_renamer - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral2/files/0x000700000001b811-26.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4732-25-0x0000000000AF0000-0x0000000000AF9000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4732-43-0x0000000000AF0000-0x0000000000AF9000-memory.dmp INDICATOR_EXE_Packed_ASPack - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
resource yara_rule behavioral2/memory/1216-1-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-7-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-6-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-8-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-5-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-9-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-10-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-16-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-22-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-11-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-19-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-29-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-28-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-30-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-40-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-45-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-42-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-249-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-254-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-256-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-258-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-259-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-262-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-266-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-275-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-276-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-288-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-294-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-304-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-306-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-308-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-310-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-312-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-314-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-317-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-318-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-324-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-342-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-363-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1216-376-0x0000000002680000-0x000000000373A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 44 IoCs
resource yara_rule behavioral2/memory/1216-1-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-7-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-6-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-8-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-5-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-9-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-10-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-16-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-22-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-11-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-19-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-29-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-28-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-30-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-32-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral2/memory/1216-40-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-41-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral2/memory/1216-45-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-51-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral2/memory/1216-42-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-249-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-254-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-255-0x0000000000400000-0x00000000004F1000-memory.dmp UPX behavioral2/memory/1216-256-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-258-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-259-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-262-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-266-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-275-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-276-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-288-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-294-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-304-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-306-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-308-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-310-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-312-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-314-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-317-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-318-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-324-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-342-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-363-0x0000000002680000-0x000000000373A000-memory.dmp UPX behavioral2/memory/1216-376-0x0000000002680000-0x000000000373A000-memory.dmp UPX -
resource yara_rule behavioral2/files/0x000700000001b811-26.dat aspack_v212_v242 - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Paint.lnk 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Executes dropped EXE 1 IoCs
pid Process 4732 wQWgLs.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\K: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\L: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\S: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\W: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\Z: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\R: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\H: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\J: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\M: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\O: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\P: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\U: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\V: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\D: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\G: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\T: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\X: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\I: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\N: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened (read-only) \??\Q: 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification F:\autorun.inf 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe -
resource yara_rule behavioral2/memory/1216-1-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-7-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-6-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-8-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-5-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-9-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-10-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-16-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-22-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-11-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-19-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-29-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-28-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-30-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-40-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-45-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-42-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-249-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-254-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-256-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-258-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-259-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-262-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-266-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-275-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-276-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-288-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-294-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-304-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-306-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-308-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-310-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-312-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-314-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-317-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-318-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-324-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-342-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-363-0x0000000002680000-0x000000000373A000-memory.dmp upx behavioral2/memory/1216-376-0x0000000002680000-0x000000000373A000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vOfficeC2RClient.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\RCX39F9.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX3A88.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jre-1.8\bin\vjabswitch.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe wQWgLs.exe File created C:\Program Files\7-Zip\v7z.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe wQWgLs.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe wQWgLs.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjavap.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\vaccicons.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe wQWgLs.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe wQWgLs.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe wQWgLs.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome.exe.sig 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe wQWgLs.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe wQWgLs.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjhat.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\RCX3D9C.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\vjjs.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\vSmartTagInstall.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE wQWgLs.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe wQWgLs.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX3A39.tmp 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vjmap.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE wQWgLs.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe wQWgLs.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe wQWgLs.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\vIntegratedOffice.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\vcreatedump.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\vjavac.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe wQWgLs.exe File opened for modification C:\Program Files\7-Zip\vUninstall.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\vos_update_handler.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\vjsadebugd.ico 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\vklist.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe wQWgLs.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe wQWgLs.exe - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e59019c 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Windows\SYSTEM.INI 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe File opened for modification C:\Windows\bfsvc.exe 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3328 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wQWgLs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe Token: SeDebugPrivilege 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 1172 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 15 PID 1216 wrote to memory of 2508 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 45 PID 1216 wrote to memory of 3188 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 48 PID 1216 wrote to memory of 3444 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 49 PID 1216 wrote to memory of 3300 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 1216 wrote to memory of 4356 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 1216 wrote to memory of 4420 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 1216 wrote to memory of 4464 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 1216 wrote to memory of 4724 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 63 PID 1216 wrote to memory of 4996 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 64 PID 1216 wrote to memory of 1272 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 1216 wrote to memory of 5148 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 66 PID 1216 wrote to memory of 2684 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 80 PID 1216 wrote to memory of 1004 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 81 PID 1216 wrote to memory of 4652 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 82 PID 1216 wrote to memory of 944 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 1216 wrote to memory of 4840 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 84 PID 1216 wrote to memory of 4732 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 90 PID 1216 wrote to memory of 1172 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 15 PID 1216 wrote to memory of 2508 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 45 PID 1216 wrote to memory of 3188 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 48 PID 1216 wrote to memory of 3444 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 49 PID 1216 wrote to memory of 3300 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 1216 wrote to memory of 4356 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 1216 wrote to memory of 4420 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 1216 wrote to memory of 4464 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 1216 wrote to memory of 4724 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 63 PID 1216 wrote to memory of 4996 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 64 PID 1216 wrote to memory of 1272 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 1216 wrote to memory of 5148 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 66 PID 1216 wrote to memory of 2684 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 80 PID 1216 wrote to memory of 1004 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 81 PID 1216 wrote to memory of 4652 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 82 PID 1216 wrote to memory of 944 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 1216 wrote to memory of 4840 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 84 PID 1216 wrote to memory of 4732 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 90 PID 1216 wrote to memory of 4732 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 90 PID 1216 wrote to memory of 1172 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 15 PID 1216 wrote to memory of 2508 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 45 PID 1216 wrote to memory of 3188 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 48 PID 1216 wrote to memory of 3444 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 49 PID 1216 wrote to memory of 3300 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 1216 wrote to memory of 4356 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 1216 wrote to memory of 4420 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 1216 wrote to memory of 4464 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 1216 wrote to memory of 4724 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 63 PID 1216 wrote to memory of 4996 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 64 PID 1216 wrote to memory of 1272 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 65 PID 1216 wrote to memory of 5148 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 66 PID 1216 wrote to memory of 2684 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 80 PID 1216 wrote to memory of 1004 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 81 PID 1216 wrote to memory of 4652 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 82 PID 1216 wrote to memory of 944 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 83 PID 1216 wrote to memory of 4840 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 84 PID 1216 wrote to memory of 1172 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 15 PID 1216 wrote to memory of 2508 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 45 PID 1216 wrote to memory of 3188 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 48 PID 1216 wrote to memory of 3444 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 49 PID 1216 wrote to memory of 3300 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 57 PID 1216 wrote to memory of 4356 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 59 PID 1216 wrote to memory of 4420 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 60 PID 1216 wrote to memory of 4464 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 61 PID 1216 wrote to memory of 4724 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 63 PID 1216 wrote to memory of 4996 1216 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe 64 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2508
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3188
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3444
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3300
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4464
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4724
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000026C;0000000000000270;1⤵PID:4996
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:1272
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5148
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2684
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_26088d38fb8007b80c681f2315a74c55_darkgate_elex_gcleaner_smoke-loader_tainp_wapomi.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Drops startup file
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\wQWgLs.exeC:\Users\Admin\AppData\Local\Temp\wQWgLs.exe4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\06806972.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3328
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4652
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:944
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:4840
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 841KB
- SHA256 48706f46cd2f477d11257c9718fae732bc492da05a0de07db4bd32960a34cf32
- MD5 ba4ca0507dfb24c09904ffb9cee1872d
- SHA1 0c13be48913dc78b31a1fa457735e5c4a73f7e2a
- SHA512 24c1dd44649e050aec58e85ca57f8155ac41be1cf56662de05c851aefda85dbc28a8e21af578e98a7c8687d21118a61f5e3dee38258df091a5aeff46ffc8adf7
- SSDEEP 12288:twCBtLC+EptUpQ9SeSChq3YvxFBSSRMT8PTp4ihozEi888888888888W8888888X:hNzCtUpQ9WWPBSSRMTEpXN
- TLSH T12D055A1AB2D7143BC03706BD492752645C3B7E202A96585A5EFCBF4C0F392A33D36E96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 31KB
- SHA256 36619fe796b01ba0c8811f5d62a7113109c9f9a7d10c386a7213c040b261df60
- MD5 b99754fd53f0296256e82764d7ae1e48
- SHA1 64e31ecbabba2083032a9ba9b2710f4136744fde
- SHA512 4cae0cf0417d9434b7bfa93df68adf1c4aea3325ecbac82640980ad26ce981c4135eda3a579d503d48014790885c29e6c087bddf833f0647e500f9d397a06f87
- SSDEEP 768:6WQ3655Kv1KjqY1MNHnhQGPL4vzZq2o9W7GsxBbPr:6HqaN6qHnGGCq2iW7z
- TLSH T11FE28D53CF9054F6E7EF253160FA3A478AB7AD2089A4EE5F83707A9D1C34600E866257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\vjavaws.ico
- Size 4KB
- SHA256 611f2cb2e03bd8dbcb584cd0a1c48accfba072dd3fc4e6d3144e2062553637f5
- MD5 38b41d03e9dfcbbd08210c5f0b50ba71
- SHA1 2fbfde75ce9fe8423d8e7720bf7408cedcb57a70
- SHA512 ec97556b6ff6023d9e6302ba586ef27b1b54fbf7e8ac04ff318aa4694f13ad343049210ef17b7b603963984c1340589665d67d9c65fec0f91053ff43b1401ba9
- SSDEEP 96:GxZnQuikS0jj8KJy9QhT8PB5CXMaTFgL3n:GxZQuiQjruQ65wXMWA
- TLSH T10391ABB2F18998D5DC566D73453EAC7250E37EAD89E68A0D109F73158AF338110E6E0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\vIntegratedOffice.ico
- Size 4KB
- SHA256 a058bfd185fe714927e15642004866449bce425d34292a08af56d66cf03ebe6c
- MD5 3ea9bcbc01e1a652de5a6fc291a66d1a
- SHA1 aee490d53ee201879dff37503a0796c77642a792
- SHA512 7c740132f026341770b6a20575786da581d8a31850d0d680978a00cc4dfca1e848ef9cdc32e51bae680ea13f6cc0d7324c38765cb4e26dcb2e423aced7da0501
- SSDEEP 48:r2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:r6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
- TLSH T12291553EA718B8B0F94E6DB1236FC064501E7504141BCDA6B1A9FCB07F92CEA40147CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\vmisc.ico
- Size 4KB
- SHA256 3cc5043caa157e5f9b1870527b8c323850bdae1e58d6760e4e895d2ab8a35a05
- MD5 fc27f73816c9f640d800cdc1c9294751
- SHA1 e6c3d8835d1de4e9606e5588e741cd1be27398f6
- SHA512 9e36b96acc97bc7cd45e67a47f1ae7ab7d3818cc2fdaad147524ce9e4baedfaac9cd012923ec65db763bfd850c65b497376bb0694508bee59747f97bf1591fd4
- SSDEEP 12:GFXAOAO9XAkXRABEXAOAOANXAO6qOyvOyYvOy44o4v44PQ91pnSqu:GiB7GABbBBa1qlvlYvl44o4v44PQP/u
- TLSH T171916492593E9DF8C1550930C99FCFA14E341C1744505542E7F2AECF9EB1B50F61B668
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\06806972.bat
- Size 187B
- SHA256 45bcdc7fdf2d3fb6f26ccf70ccbddbf30b7530d76f4bfd2ac67bf83536fccd74
- MD5 1ace14b0b58f3a7e28cc9098489227b8
- SHA1 32466c56a084e6bedc9b50668bfbcf760f9e107c
- SHA512 a9a1fea13adaa22b607d902ff5a33c42173d2041e141f996bce3edd39e01d8bfebb20124b4573b1df7163554f69b6c44b55edf0e5d893e1a0dd5bd712e2a71e5
- TLSH T189C01202C2D6CA9D2558525766E6614CD06508583FAD2F115B20C45C65B6D0DFADBB41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2D196FFB.exe
- Size 1B
- SHA256 08f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
- MD5 69691c7bdcc3ce6d5d8a1361f22d04ac
- SHA1 c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
- SHA512 253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wQWgLs.exe
- Size 15KB
- SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
- MD5 56b2c3810dba2e939a8bb9fa36d3cf96
- SHA1 99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
- SHA512 27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
- SSDEEP 384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
- TLSH T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\autorun.inf
- Size 102B
- SHA256 94e323bd9071db7369ade16f45454e7a0dbfb6a39efddc1234c4719d1f7ee4c2
- MD5 5513829683bff23161ca7d8595c25c72
- SHA1 9961b65bbd3bac109dddd3a161fc30650e8a7096
- SHA512 308c84446106cda0a71e37b0de46aaf4b7361f9ddcc3c4c29f8e87da8acb606525dce8a42caf9d74e708c56b31c524f9535a2f5f4757c6c357401da1c495ddb6
- TLSH T14EB09226D649C1051E8AB608D0088139F46DA31E01B0A2030AA8F89AC461148CB30862
- MD5 SHA1 SHA512 TLSH
- Path F:\xqeilt.pif
- Size 97KB
- SHA256 6a1a2aa59ee4825bcd5784cc982d24b81a26da2d791891f5c56c24157435d9fd
- MD5 6330b63ad5afcbe51ad380854a208da1
- SHA1 1350f0475bf8e0a3e1b5b33925171e881e44b1c0
- SHA512 34a3d6509ffcb7e0746cb82884a92d29cd4ec12c156a70e3d25978a68fbbfd93d276f33b662b1bb39ff7853a0af16b7f1fa639fad8fd0d2493839e257901218d
- SSDEEP 1536:VkIbAO0bTlhn9LjLEd72tB9KONh5HKwwCbH/jShZg7o:V/SbTlhn9vLEdKM85wy/GZU
- TLSH T113A3024E6BF15203C9F58838016BC6C88ED374F139B69C5E9E2524D5E931BE0B2DA357
- MD5 SHA1 SHA512 SSDEEP TLSH