Overview

overview

4

Static

static

3

2026-08-16...ry.exe

windows10-2004-x64

4

2026-08-16...ry.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 15:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe
  • Size 199KB
  • Sample260816-sr92caec23
  • SHA256 fd4b4975e472c9933ad08b86c15deef4765d37c36f078a0331f785dd7983ca45
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 19 IoCs
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0db5c77efabdfda96b71efcc48ab94a9_amadey_darkgate_elex_gcleaner_wannacry.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4256
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 420
          4⤵
          • Program crash
          PID:1848
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4256 -s 420
          4⤵
          • Program crash
          PID:4816
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 440
        3⤵
        • Program crash
        PID:4748
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 440
        3⤵
        • Program crash
        PID:1164
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 468
      2⤵
      • Program crash
      PID:3416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 468
      2⤵
      • Program crash
      PID:2688
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4720 -ip 4720
    1⤵
      PID:2068
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4720 -ip 4720
      1⤵
        PID:1968
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2996 -ip 2996
        1⤵
          PID:1784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2996 -ip 2996
          1⤵
            PID:1640
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4256 -ip 4256
            1⤵
              PID:2984
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4256 -ip 4256
              1⤵
                PID:2736

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    Uninstall.exe
                    • Path C:\Program Files\7-Zip\Uninstall.exe
                    • Size 199KB
                    • SHA256 3936fdaff0a336c050d19548855c3db0715e62fe2a2c3ad6a15d34a937e02355
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RCXEEC2.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXEEC2.tmp
                    • Size 199KB
                    • SHA256 fd4b4975e472c9933ad08b86c15deef4765d37c36f078a0331f785dd7983ca45
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEEF2.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEEF2.tmp
                    • Size 734KB
                    • SHA256 62218bd529a7c6c8e9a2697e964fae4ca4e8a0ac31d61d138dbda7aa26dc7215
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEF24.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEF24.tmp
                    • Size 1.1MB
                    • SHA256 455a0b765b970c1bec1b7ba3ea4836828122ce8dbdf68925c1d23cc4b1e24630
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEF36.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEF36.tmp
                    • Size 878KB
                    • SHA256 85aaa1d99057c0991fdceb30a0957154e8444381061d39916775c6412dfa2e90
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEF5C.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEF5C.tmp
                    • Size 2.3MB
                    • SHA256 d604257b490d74fc9089c1dda2ce7e77b4376e5d114e5b32af72db288a3fdbee
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEF7E.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEF7E.tmp
                    • Size 467KB
                    • SHA256 aed42df0ffe6278f1cce4d075404306b4c6f598b562f0cd3aceb65085b8ad38d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEF81.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEF81.tmp
                    • Size 233KB
                    • SHA256 08ffce515a15906429ab608d387053f2ff6c542ebfca66ebf84abd1a1019aba2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEFA3.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEFA3.tmp
                    • Size 4.4MB
                    • SHA256 ced49161ffaecf2358e14f310df1334f360869fbf39e3bbf8f10a28ce9aba06d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEFC5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEFC5.tmp
                    • Size 544KB
                    • SHA256 8e7960ced045c5ea09e833da912f4f14df7b305af87ec9c975477fa223e8af26
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcF017.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcF017.tmp
                    • Size 23.7MB
                    • SHA256 cbc49c697731c488eaac6f17eb398c73cddc4e1615dd6b80631773fb97a9d79a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcFAB7.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcFAB7.tmp
                    • Size 276KB
                    • SHA256 eaa85d577ad5dd7edd99bea3f5a3e86829377e46178a664d3b56ff1adc7e49b6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/2996-222-0x0000000000400000-0x000000000043C000-memory.dmp
                    Download

                    memory/4256-229-0x0000000000400000-0x000000000043C000-memory.dmp
                    Download

                    memory/4720-194-0x0000000000400000-0x000000000043C000-memory.dmp
                    Download