Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 21:36
Behavioral task
behavioral1
Sample
2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe
- Size 1.3MB
- Sample260805-1f2jtsgn2x
- SHA256 a94630fdbabf5ca1f98c81032bf1bcd0f1b2710ea2feaf7dacb55e963185e25c
- MD5 248418e40f36c6ca9780bfa813652db9
- SHA1 0ca99e5c95564a569f9e6096a4997bd351d20e77
- SHA512 e57d509f063633bddb271cd6cd7de1c7aba6d146ab466914eceac39383aecef60d8904e8376d3ffee8393fa30bafc17fbae9d3a9471494ce6525517cac6344f1
- SSDEEP 24576:1IVM/IabjKoh9WsExsVXpDaewsAjH2ROf1IegqutJQ5FpS:t/IabjKoh9WsEeVZ2ljH2RAR5FM
- TLSH T1DF554912A760D961C16E04F339E68333ADB47D800A221787F790FF999B33AD167E7616
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\choice.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\more.com 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe -
resource yara_rule behavioral2/memory/1240-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c625-5.dat upx behavioral2/memory/1240-1031-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1240-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\r\DeviceCredentialDeployment.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.26100.1591_none_2af0eb0ad05bac33\r\tzsync.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\r\regedit.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_8bd012a12d6af1f7\ntprint.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasphone.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\WaaSMedicAgent.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCPROP.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\notification_helper.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\r\BootExpCfg.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-keygen.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\omadmprc.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\r\OpenWith.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\WpcMon.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_b3595e41e3c0336d\waitfor.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WMIADAP.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\relog.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\r\GenValObj.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_73fd08cefdd719a5\RegAsm.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\chkdsk.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\at.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\r\PickerHost.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_04bcf928bfc9ab50\jsc.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\r\ldp.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\HealthAttestationClientAgent.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_895815212ed14bd2\timeout.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.26100.1_none_9d1627fd03aed8d9\LogCollector.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_9493bccc1124c937\mshta.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\iexpress.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\powershell_ise.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1_none_dd2e628f17bcb344\TSTheme.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\sdbinst.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\r\explorer.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmBroker.exe- 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_248418e40f36c6ca9780bfa813652db9_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.2MB
- SHA256 a8b2e22c3cb6575618176bc0e4b0484fc8f2ea5fca09d78ebd069f05399bb7fd
- MD5 8ac9394ce56e3346eb95b1339f314ba2
- SHA1 a49b7bdfc9f3e8fd5fd1a406cf2da75cb93b91a0
- SHA512 c06098207549e98ab0564d844854234620809fbdf5d8b3296eaf5682b31c0494ccc43e2c21d6ffdf2ccbfe9f1e65509e6abebfde2230721db5fe260e62c63b22
- SSDEEP 49152:t/IabjKoh9WsEeVZ2ljH2RAR5F9/ezSC6vUzPvMHjy2:1IabjKoh9WsEkZm5ezSC6v2XMHD
- TLSH T1F5B53811B6748722C0BA80B6D5D6A76BFD713C810B304BCB9345FB682F33AE19676725
- MD5 SHA1 SHA512 SSDEEP TLSH