Overview

overview

7

Static

static

3

2026-08-16...er.exe

windows10-2004-x64

7

2026-08-16...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
  • Size 544KB
  • Sample260816-13phsabl4w
  • SHA256 8e7960ced045c5ea09e833da912f4f14df7b305af87ec9c975477fa223e8af26
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 48 IoCs
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3852
    • C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-16_09d274994013262d0ffb3590c2fd8495_amadey_darkgate_elex_gcleaner_glassworm_hawkeye_smoke-loader.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:6096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 476
          4⤵
          • Program crash
          PID:596
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 420
          4⤵
          • Program crash
          PID:2184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 488
        3⤵
        • Program crash
        PID:4576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 508
        3⤵
        • Program crash
        PID:5800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 516
      2⤵
      • Program crash
      PID:4864
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 572
      2⤵
      • Program crash
      PID:5156
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 6096 -ip 6096
    1⤵
      PID:2884
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6096 -ip 6096
      1⤵
        PID:5832
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3852 -ip 3852
        1⤵
          PID:5724
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3852 -ip 3852
          1⤵
            PID:5716
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2164 -ip 2164
            1⤵
              PID:5036
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2164 -ip 2164
              1⤵
                PID:912

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    RCX8DF9.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCX8DF9.tmp
                    • Size 438KB
                    • SHA256 3fc3d01e8814643c072ab0cca883ce13f95a2ff14b97d56170f132c73d255741
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc7BFC.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc7BFC.tmp
                    • Size 1.8MB
                    • SHA256 673a236f0f80ee7a43f6f08fb2899f5172181342687506fe5dd0ac22b14bba0b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc89F9.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc89F9.tmp
                    • Size 2.5MB
                    • SHA256 016e0f6d1546eb2e75ff7571300de6cb4d16387485ffca94da953917f058c95f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc8DC5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc8DC5.tmp
                    • Size 644KB
                    • SHA256 4f987251f8a2c2d0edcc89b32de10e841f92b319b1fde80f28d9146aa3d06a91
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc8F61.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc8F61.tmp
                    • Size 26.8MB
                    • SHA256 d8f45b117cd2859f4b169c63b7c88471d29ec7ea9f026e4388a9d57b0de4c14a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc9010.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc9010.tmp
                    • Size 985KB
                    • SHA256 8860c4ca6a623f0aadb0c407d87ab418f12c59af3b783f2e7c988f45dd8c5159
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc9033.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc9033.tmp
                    • Size 734KB
                    • SHA256 62218bd529a7c6c8e9a2697e964fae4ca4e8a0ac31d61d138dbda7aa26dc7215
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc906A.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc906A.tmp
                    • Size 199KB
                    • SHA256 fd4b4975e472c9933ad08b86c15deef4765d37c36f078a0331f785dd7983ca45
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc908D.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc908D.tmp
                    • Size 2.3MB
                    • SHA256 d604257b490d74fc9089c1dda2ce7e77b4376e5d114e5b32af72db288a3fdbee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc909F.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc909F.tmp
                    • Size 467KB
                    • SHA256 aed42df0ffe6278f1cce4d075404306b4c6f598b562f0cd3aceb65085b8ad38d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc90B2.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc90B2.tmp
                    • Size 233KB
                    • SHA256 08ffce515a15906429ab608d387053f2ff6c542ebfca66ebf84abd1a1019aba2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc90F6.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc90F6.tmp
                    • Size 544KB
                    • SHA256 8e7960ced045c5ea09e833da912f4f14df7b305af87ec9c975477fa223e8af26
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc92BE.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc92BE.tmp
                    • Size 442KB
                    • SHA256 5dd5cd6e4f084781ca4abbe90b015221adbe0b9775769e8b155ed545d121d9ec
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc92D1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc92D1.tmp
                    • Size 282KB
                    • SHA256 5c04ef1d4beb7b391193f624d9871527fd792c74bd378ffe297f44edd0316f5f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc9315.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc9315.tmp
                    • Size 241KB
                    • SHA256 ad2bff39389d7cb60c2cb5b098112da4a1c9e6ca48b583a069422ebc2b487221
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc9385.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc9385.tmp
                    • Size 249KB
                    • SHA256 5677ff47afba8b9d8e84ea2ca8c420c1a2f2cb6f7e533736f6cdbcc2dd6328e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc93C7.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc93C7.tmp
                    • Size 245KB
                    • SHA256 b618915347489f4a3e45e2052c410bc3687f31c452b258390e343ab2c082c29c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc969C.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc969C.tmp
                    • Size 1.6MB
                    • SHA256 82b8a8522709e2d84e9ce3e6c2850402a7dca4531ba42bc08deafec623c7926e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA19E.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA19E.tmp
                    • Size 3.6MB
                    • SHA256 8b472f436e91aa7b677477c374c1f61fab20e8ac81c4d8cb468e69b999cabe87
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA1C0.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA1C0.tmp
                    • Size 2.4MB
                    • SHA256 95eeb8d39d3c99fe6f2f11aab958372d70136229c64c670acb4f6f7b850ebdae
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA454.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA454.tmp
                    • Size 1.8MB
                    • SHA256 e18fef52efdfd016fc47b7368671772638a24fcd2da58b395255a95efd695398
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA466.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA466.tmp
                    • Size 2.0MB
                    • SHA256 76dd644ed8130c79b366a53f30375cb4969c4e75859adaff4acafd04f6eff5a4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcADB0.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcADB0.tmp
                    • Size 6.2MB
                    • SHA256 aa65d8b1916873f5e33521cceceb8fccbcc17fcf27c5ec43fd441a3caacffb73
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcB2AB.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcB2AB.tmp
                    • Size 600KB
                    • SHA256 54c7db69ef90690e46a4d0684713fbbcd182a3520bfcf6d31a7b60b7ebf6b967
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcB414.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcB414.tmp
                    • Size 620KB
                    • SHA256 af5484694bb201d3423d0f436d3ba07dcb03501a7f3bceb1432b48488c69315f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2164-328-0x0000000000400000-0x0000000000492000-memory.dmp
                    Download

                    memory/3852-221-0x0000000000400000-0x0000000000492000-memory.dmp
                    Download

                    memory/3852-318-0x0000000000400000-0x0000000000492000-memory.dmp
                    Download

                    memory/6096-278-0x0000000000400000-0x0000000000492000-memory.dmp
                    Download