Overview

overview

5

Static

static

1

2026-08-04...os.exe

windows10-2004-x64

5

2026-08-04...os.exe

windows11-ltsc_2024-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
  • Size 26.1MB
  • Sample260804-rxgrbazta1
  • SHA256 570e8ee12ddb9b632623f782577ccff4a44196a07a650bada59d46911487f8d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Drops file in System32 directory 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_af38a97d3a6003853b879d3011f5d96f_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT > C:\PROGRA~2\GAMMAD~1\cs_batch.log"
      2⤵
      • Drops file in Program Files directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\SysWOW64\chcp.com
        chcp 1252
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4088
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s "C:\Windows\system32\gmcom.dll"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3108
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT > C:\PROGRA~2\GAMMAD~1\cs_batch.log"
      2⤵
      • Drops file in Program Files directory
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\SysWOW64\chcp.com
        chcp 1252
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1692
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d preview.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:5820
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1556
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d ssw.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\simple_send.dat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:2740
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5956
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d TrackingReport.ini "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\tracking_report.ini"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:1508
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1248
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d campaigns.ini "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\tracking_campaigns.ini"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:2936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5988
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d arw.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\add_record.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:3176
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo F"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1460
      • C:\Windows\SysWOW64\xcopy.exe
        xcopy /y /d single.dat "C:\Users\Admin\AppData\Roaming\Gammadyne\10006\single_send.xml"
        3⤵
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        PID:5184
      • C:\Program Files (x86)\Gammadyne Mailer\SQLite\SQLiteODBCInstaller.exe
        sqliteodbcinstaller.exe /i /d=sql3 /q
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3512
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5912
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\Gammadyne Mailer\readme.txt
      1⤵
        PID:2456

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            SETUPBAT.BAT
            • Path C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT
            • Size 4KB
            • SHA256 2c21d100867c54e0c1358bc35863fca94b9a3aeed4bda09ff371d0576f9fe259
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SETUPBAT.BAT
            • Path C:\PROGRA~2\GAMMAD~1\SETUPBAT.BAT
            • Size 3KB
            • SHA256 896120cff0539dce3f1195606767bb931f8f22caed5f75706ca0714f91fc106a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            SQLiteODBCInstaller.exe
            • Path C:\Program Files (x86)\Gammadyne Mailer\SQLite\SQLiteODBCInstaller.exe
            • Size 125KB
            • SHA256 d566a311e9f6e78faeb12a9ed31823a580d2ed7143021cc5324c6b98ca96b1d3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3odbc.dll
            • Path C:\Program Files (x86)\Gammadyne Mailer\SQLite\sqlite3odbc.dll
            • Size 1.3MB
            • SHA256 7e57124a66105bcbf08b12737a61f0eb63abf26db6d79df1df56d2f9e5e2bd82
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scheduler.ico
            • Path C:\Program Files (x86)\Gammadyne Mailer\Uninstall\scheduler.ico
            • Size 158KB
            • SHA256 70e7b5befe82876b3bd645ffd5e2a0a8834642e89c7164b76558d2d35f2f7080
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cs_batch.log
            • Path C:\Program Files (x86)\Gammadyne Mailer\cs_batch.log
            • Size 233B
            • SHA256 f4cad1c796defda68e83cfaf9d0e28c89b2348be42600aef0ac2e99b65858156
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            gm.exe
            • Path C:\Program Files (x86)\Gammadyne Mailer\gm.exe
            • Size 21.0MB
            • SHA256 26222183d80018f1d740841e2304512df9613bee44b2f61daa8b8b64466f3b63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            readme.txt
            • Path C:\Program Files (x86)\Gammadyne Mailer\readme.txt
            • Size 5KB
            • SHA256 28ebd3b9bfb9156555141075ce171c0ddccba159b22b13b3c3b7c5958fdcb3b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scheduler.exe
            • Path C:\Program Files (x86)\Gammadyne Mailer\scheduler.exe
            • Size 253KB
            • SHA256 835acbf0088d3335701738d0e969a05fd3b8eae89daa43036d2e5a9305a63c3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gmcom.dll
            • Path C:\Windows\SysWOW64\gmcom.dll
            • Size 5.6MB
            • SHA256 6a3ae382d0a029a151ad6d4c3feeb3f59dc9869eabe0c72cee753d8848a8ccf4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download