Analysis
- max time kernel
150s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe
- Size 7.9MB
- Sample260808-trf9pshr6s
- SHA256 53b558ba85e466b01274bd9b6b176e2b17eb54670fba764ec89233a0b899801c
- MD5 3dd1d60806f02850dd30c1d6859a6833
- SHA1 b144ca51fea470e7d1649d6112a67658fe5ae155
- SHA512 317b006bb2f511c101e365f0df3bcfe8677b6d8b977cb3f1bb31fb1aa345f60bac9f31963ce463c0084d716226748828080a3f8e3f3e514868858419a488c16f
- SSDEEP 98304:CeYOXwnS4rVWYOXwnS4rV62AIDQneYOXwnS4rVWYOXwnS4rV62AIDQe:mI6IXuQPI6IXuQe
- TLSH T1AF868C01B7D28076D4A22270442E67645736FF712F32D6DBAB443A1AAE717C18D363BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1284 2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3dd1d60806f02850dd30c1d6859a6833_amadey_darkgate_elex_emotet_glassworm_nymaim_ramnit_rhad.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 10.0MB
- SHA256 944d15262a79789832bedc751928c289210ed16897f089b639a29df27cc623f3
- MD5 d6bfc297a0bb5a70ee8dd34426c37541
- SHA1 2064d4df8e3a6ed6021734968a55cbc552863bc7
- SHA512 f407c307e1e614012b9880b9190598fe736bae8cf656988f9bb1f6a8e3b571a8d5be66d1c7fd37baa766044da721812b9f119861fee2b166a983def78bee7f8a
- SSDEEP 98304:CeYOXwnS4rVWYOXwnS4rV62AIDQneYOXwnS4rVWYOXwnS4rV62AIDQ+oq2Vjnmk:mI6IXuQPI6IXuQ+Gnn
- TLSH T186B69D02B7D1C076D0A26270856A9755A336BE711F32D7DFAB443A0EAE327C18D36376
- MD5 SHA1 SHA512 SSDEEP TLSH