Overview

overview

7

Static

static

3

2026-07-29...er.exe

windows10-2004-x64

7

2026-07-29...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
  • Size 543KB
  • Sample260729-vyaaeack8x
  • SHA256 f0f57cfd9fbce4e9478d5563d3f0e11de72c0e0c3b1c226d04c8291492b44501
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Program crash 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3276
    • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
          4⤵
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
            5⤵
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3608
            • C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
              "C:\Users\Admin\AppData\Local\Temp\2026-07-29_96afd118cf833781cce803e5d675b0b9_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
              6⤵
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4368
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 432
                7⤵
                • Program crash
                PID:5312
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 512
                7⤵
                • Program crash
                PID:5492
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 508
              6⤵
              • Program crash
              PID:4848
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 508
              6⤵
              • Program crash
              PID:2812
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 516
            5⤵
            • Program crash
            PID:5252
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 516
            5⤵
            • Program crash
            PID:5572
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 476
          4⤵
          • Program crash
          PID:4660
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 536
          4⤵
          • Program crash
          PID:4416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 472
        3⤵
        • Program crash
        PID:2992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 488
        3⤵
        • Program crash
        PID:3292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 500
      2⤵
      • Program crash
      PID:2316
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 532
      2⤵
      • Program crash
      PID:4760
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3276 -ip 3276
    1⤵
      PID:4568
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3276 -ip 3276
      1⤵
        PID:2420
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2868 -ip 2868
        1⤵
          PID:4856
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2868 -ip 2868
          1⤵
            PID:2076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4368 -ip 4368
            1⤵
              PID:5592
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4368 -ip 4368
              1⤵
                PID:3804
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1620 -ip 1620
                1⤵
                  PID:5620
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1620 -ip 1620
                  1⤵
                    PID:4596
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2228 -ip 2228
                    1⤵
                      PID:2416
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2228 -ip 2228
                      1⤵
                        PID:3004
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3608 -ip 3608
                        1⤵
                          PID:4284
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3608 -ip 3608
                          1⤵
                            PID:4912

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                RCX504B.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RCX504B.tmp
                                • Size 733KB
                                • SHA256 5cd76dbd2e08bbddc9889b33fd829cb9cea6139a4f9fa951c37ec5167648036a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RCXA608.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RCXA608.tmp
                                • Size 566KB
                                • SHA256 555ba0d9517419c237080211bf632de7b2371f2fa51696dc8734896d7f4462aa
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RCXA62B.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RCXA62B.tmp
                                • Size 577KB
                                • SHA256 b2c0eab6a766c415ac6ed937671f734641de04f6ad69a71936f3be006252cc13
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RCXA900.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RCXA900.tmp
                                • Size 6.2MB
                                • SHA256 abdc36262c649a4313702752243f4fab1ea094ae15ad964558021055bcb0e5e2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                RCXA911.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\RCXA911.tmp
                                • Size 6.2MB
                                • SHA256 024208ec6caded491bd39cf3334a669ac6955cb397d31be68003762f74887abe
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc507B.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc507B.tmp
                                • Size 1.1MB
                                • SHA256 33c263a3e7c5670eef1e36fe346331d0fcb9686bc339ed3cfd37608289935529
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc508D.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc508D.tmp
                                • Size 876KB
                                • SHA256 488b7e546400cd1f62be4a542403e743fce829f56010ae597ba2716d2910b3a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc5851.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc5851.tmp
                                • Size 198KB
                                • SHA256 fe11d07fe4110686d24e079342ec35447bb94a8d4463ed629eaf74248867f0a0
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc5863.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc5863.tmp
                                • Size 2.3MB
                                • SHA256 a7c71eda1802771092063b3602610709bfec56bff7722bc2bb78ff211fe33527
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc5886.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc5886.tmp
                                • Size 465KB
                                • SHA256 0daf9eb08e6e202b3869871db288e4e6f61ffee682fa3bea54cbe778e276125f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc5898.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc5898.tmp
                                • Size 231KB
                                • SHA256 2ff96a417139797dee2153924763e68fb50a70508e0047737a037df3d48e51b2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc687A.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc687A.tmp
                                • Size 4.3MB
                                • SHA256 a42bcdc8c5a17679ed57f2c5407cb7145ef89a2edee2f42abb12a710be695d0f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc689C.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc689C.tmp
                                • Size 543KB
                                • SHA256 f0f57cfd9fbce4e9478d5563d3f0e11de72c0e0c3b1c226d04c8291492b44501
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc691C.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc691C.tmp
                                • Size 23.6MB
                                • SHA256 115e0d03818b6707682765bc006cd6615cb10cd179dbe9db866ec44aebc70cf1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc7B87.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc7B87.tmp
                                • Size 763KB
                                • SHA256 6bb2898f7fbfb21047c3e4beb6f9d83d427f3fc93abe263e277b44545f861f67
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc882C.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc882C.tmp
                                • Size 441KB
                                • SHA256 83c9cb20fd3edfe7fbea1478ca621c6c4f97fa4b0c69f9dc02ffcfe530538251
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc883F.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc883F.tmp
                                • Size 280KB
                                • SHA256 e4fff0b5351e51f1ac3e4b1852ad84d9688b7ac87d36463af0aa71fc0f54be65
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc95A0.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc95A0.tmp
                                • Size 609KB
                                • SHA256 bcf773b646b01fd3429631a09f3fe761e2ba779b296da363be4639db801608b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc9B3C.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc9B3C.tmp
                                • Size 431KB
                                • SHA256 cb0480f8886969c908fff7e12106a8863ced4f2222be4cf0acb2634df754fb5b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUc9B6E.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUc9B6E.tmp
                                • Size 638KB
                                • SHA256 393d898b7b2938ca3cb9a8dee3abcbc72b7e01279b07db991a6736a036cf5ce5
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA64E.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA64E.tmp
                                • Size 240KB
                                • SHA256 254454a8ed1315308180aeeb9f8e3d73ec022f4c6bbe9740703d65725c7b0053
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA69F.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA69F.tmp
                                • Size 248KB
                                • SHA256 cf94e0f6a1c6674ce6db4d77cb0e3ec93073078b763368d6ac0f74bd7f4ecc00
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA6E0.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA6E0.tmp
                                • Size 244KB
                                • SHA256 9e62c12c113850720a46a5696c753f0129035beb691a50072660330b47baad4b
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA7A2.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA7A2.tmp
                                • Size 1.6MB
                                • SHA256 02b6bb7e453a98aac0c4148411e1dedbbacdc9337b7b6d3db4af217d4554df1f
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA7E6.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA7E6.tmp
                                • Size 3.6MB
                                • SHA256 27300d0a31af893710f5c8cd09c6bcc06fee82aec292eacb29789d067f574341
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA886.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA886.tmp
                                • Size 2.4MB
                                • SHA256 365cd59f0f4975e48706c5a47278d06fc9c32e7c542f4fe9b3a7a4903b74e9f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA898.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA898.tmp
                                • Size 1.8MB
                                • SHA256 0b879e1efa9e5abbc587c52485aec5f4f21182ed6dcfefcd4428e85f730818ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                pUcA8AB.tmp
                                • Path C:\Users\Admin\AppData\Local\Temp\pUcA8AB.tmp
                                • Size 2.0MB
                                • SHA256 3721ee4ac928dac8ad921e195acf1b008841557049746d84ef73c13439ead2ae
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/1620-349-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/2228-380-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/2868-301-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/3276-173-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/3276-154-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/3276-101-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/3608-397-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download

                                memory/4368-325-0x0000000000400000-0x0000000000492000-memory.dmp
                                Download