Overview

overview

10

Static

static

10

2026-08-02..._r.exe

windows10-2004-x64

9

2026-08-02..._r.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    89s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 17:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_8e865518862a84edc8904ea1c0519478_amadey_darkgate_elex_glassworm_icedid_manuscrypt_njrat_r.exe
  • Size 4.3MB
  • Sample260802-v932vsdd89
  • SHA256 e7a54b58e48bceac3fbf5922d9c389635295ef710ee68d9864f9a5f74185ed69
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistence

Malware Config

Signatures

  • Detects executables packed with ASPack 14 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8e865518862a84edc8904ea1c0519478_amadey_darkgate_elex_glassworm_icedid_manuscrypt_njrat_r.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8e865518862a84edc8904ea1c0519478_amadey_darkgate_elex_glassworm_icedid_manuscrypt_njrat_r.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3752
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 4.3MB
        • SHA256 e7a54b58e48bceac3fbf5922d9c389635295ef710ee68d9864f9a5f74185ed69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge_X64_139.0.3405.125.exe$
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe$
        • Size 4.4MB
        • SHA256 fae94cb323c4ba08afa521ddaf5bca84e64c37a5f34f7bc1545a1a8cdbd87934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        • Size 4.4MB
        • SHA256 8c7d70ba2618a8849281ad926fdcdac7b9ca939784ee45d7b698822e1c2c9de1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 4.8MB
        • SHA256 ca90a100ba59e55cf7e094cc85e44a9a5e1783d10368b7298137f215a78d1482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe$
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
        • Size 4.3MB
        • SHA256 e0b06f72d6adfafeb3916e773b922bc5f3a10b1edbac92bf43df318f7c94926d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SmartTagInstall.exe$
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$
        • Size 4.3MB
        • SHA256 c9489128855392e896179c5a082a1c1e54a986be0d7cdc5a50ca4a8c077e181e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 4.3MB
        • SHA256 858ca7993f76ce503b0fd8986e9f9259549d1966dc42c209f9de44b66ea05c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XamlViewer_v0300.exe
        • Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe
        • Size 4.3MB
        • SHA256 570e282a18731059c1350e7b994198469856937aa373489c1e2084bf531d17a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        XamlViewer_v0300.exe$
        • Path C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe$
        • Size 4.4MB
        • SHA256 191d71bbd3186a0351ec9d282eea18a05205b241f0c657d455ed95ab34f5289b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dfsvc.exe$
        • Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
        • Size 4.3MB
        • SHA256 2c4a716ada904729e856dcb7ba450e83f4cc2d3561e0bf276d3f1d44a4d8d030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/976-1358-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/976-7-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/3752-1357-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/3752-0-0x0000000000400000-0x000000000040D000-memory.dmp
        Download