Analysis
- max time kernel
146s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 03:32
General
- Target 2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry.exe
- Size 25.0MB
- Sample260730-d3tfeabb83
- SHA256 d873393ba5d0b51bf49ae5b0501e705fe1ac3866d8273db8d670ba9f5afd3556
Malware Config
Signatures
- Detects executables built or packed with MPress PE compressor 49 IoCs
- UPX dump on OEP (original entry point) 47 IoCs
- AutoIT Executable 47 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4c9ded8a736ab405c67cf15fced43f74_amadey_darkgate_gcleaner_glassworm_mimic_pay2key_stop_wannacry.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/432-0-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-3-0x000000014011D000-0x000000014011E000-memory.dmp
memory/432-100-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-101-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-104-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-105-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-106-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-107-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-108-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-109-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-110-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-111-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-112-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-113-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-114-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-115-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-116-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-117-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-118-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-119-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-120-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-121-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-122-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-123-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-124-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-125-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-126-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-127-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-128-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-129-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-130-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-131-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-132-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-133-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-134-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-135-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-136-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-137-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-138-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-139-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-140-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-141-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-142-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-143-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-144-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-145-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-146-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-147-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-148-0x0000000140000000-0x00000001418FD000-memory.dmp
memory/432-149-0x0000000140000000-0x00000001418FD000-memory.dmp