Overview

overview

5

Static

static

1

2026-08-04...os.exe

windows10-2004-x64

5

2026-08-04...os.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
  • Size 26.1MB
  • Sample260804-rxgrbazta1
  • SHA256 570e8ee12ddb9b632623f782577ccff4a44196a07a650bada59d46911487f8d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT > C:\PROGRA~2\GAMMAD~1\cs_batch.log"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\chcp.com
        chcp 1252
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4900
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Windows\system32\gmcom.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3892
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT > C:\PROGRA~2\GAMMAD~1\cs_batch.log"
      2⤵
      • Drops file in Program Files directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:800
      • C:\Windows\SysWOW64\chcp.com
        chcp 1252
        3⤵
        • System Location Discovery: System Language Discovery
        PID:452
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d preview.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:3300
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3672
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d ssw.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\simple_send.dat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:4956
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3844
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d TrackingReport.ini "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\tracking_report.ini"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:4344
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3404
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d campaigns.ini "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\tracking_campaigns.ini"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:1604
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1900
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d arw.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\add_record.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:4076
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5004
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d single.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\single_send.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:892
      • C:\Program Files (x86)\Gammadyne Mailer\SQLite\SQLiteODBCInstaller.exe
        sqliteodbcinstaller.exe /i /d=sql3 /q
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4736
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Gammadyne Mailer\readme.txt
    1⤵
      PID:3772

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          SETUPBAT.BAT
          • Path C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT
          • Size 3KB
          • SHA256 3a997b79d895ffd06d5ec5f770e848418b8190f1af482a8c532377fba4fa1c18
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          SETUPBAT.BAT
          • Path C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT
          • Size 4KB
          • SHA256 94b2c3107b575067af34785738329cf62ad65dad808143d73e84fff8c3130bbf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SQLiteODBCInstaller.exe
          • Path C:\Program Files (x86)\Gammadyne Mailer\SQLite\SQLiteODBCInstaller.exe
          • Size 125KB
          • SHA256 d566a311e9f6e78faeb12a9ed31823a580d2ed7143021cc5324c6b98ca96b1d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3odbc.dll
          • Path C:\Program Files (x86)\Gammadyne Mailer\SQLite\sqlite3odbc.dll
          • Size 1.3MB
          • SHA256 7e57124a66105bcbf08b12737a61f0eb63abf26db6d79df1df56d2f9e5e2bd82
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scheduler.ico
          • Path C:\Program Files (x86)\Gammadyne Mailer\Uninstall\scheduler.ico
          • Size 158KB
          • SHA256 70e7b5befe82876b3bd645ffd5e2a0a8834642e89c7164b76558d2d35f2f7080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cs_batch.log
          • Path C:\Program Files (x86)\Gammadyne Mailer\cs_batch.log
          • Size 233B
          • SHA256 f4cad1c796defda68e83cfaf9d0e28c89b2348be42600aef0ac2e99b65858156
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          gm.exe
          • Path C:\Program Files (x86)\Gammadyne Mailer\gm.exe
          • Size 21.0MB
          • SHA256 26222183d80018f1d740841e2304512df9613bee44b2f61daa8b8b64466f3b63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          readme.txt
          • Path C:\Program Files (x86)\Gammadyne Mailer\readme.txt
          • Size 5KB
          • SHA256 28ebd3b9bfb9156555141075ce171c0ddccba159b22b13b3c3b7c5958fdcb3b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          scheduler.exe
          • Path C:\Program Files (x86)\Gammadyne Mailer\scheduler.exe
          • Size 253KB
          • SHA256 835acbf0088d3335701738d0e969a05fd3b8eae89daa43036d2e5a9305a63c3c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          gmcom.dll
          • Path C:\Windows\SysWOW64\gmcom.dll
          • Size 5.6MB
          • SHA256 6a3ae382d0a029a151ad6d4c3feeb3f59dc9869eabe0c72cee753d8848a8ccf4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download