Overview

overview

7

Static

static

3

2026-08-23...ry.exe

windows10-2004-x64

7

2026-08-23...ry.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 07:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_7f51deffd928323e788a1bcf774c6c9b_amadey_darkgate_elex_gcleaner_wannacry.exe
  • Size 257KB
  • Sample260824-jlfe4sce33
  • SHA256 5e639edccd1ec968c4506b8e006221cdeca39a732a75c0bff1484053b9283377
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 20 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_7f51deffd928323e788a1bcf774c6c9b_amadey_darkgate_elex_gcleaner_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_7f51deffd928323e788a1bcf774c6c9b_amadey_darkgate_elex_gcleaner_wannacry.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4004
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_7f51deffd928323e788a1bcf774c6c9b_amadey_darkgate_elex_gcleaner_wannacry.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_7f51deffd928323e788a1bcf774c6c9b_amadey_darkgate_elex_gcleaner_wannacry.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 408
        3⤵
        • Program crash
        PID:4488
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 408
        3⤵
        • Program crash
        PID:1144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 512
      2⤵
      • Program crash
      PID:3084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 448
      2⤵
      • Program crash
      PID:5756
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4004 -ip 4004
    1⤵
      PID:1184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4004 -ip 4004
      1⤵
        PID:3596
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4964 -ip 4964
        1⤵
          PID:2372
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 4964 -ip 4964
          1⤵
            PID:4600

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                pUcA82D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA82D.tmp
                • Size 791KB
                • SHA256 7957cd86750acd6529e15bcde2b856c740f8368b254fd991a2228881341e1bd6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcA84F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcA84F.tmp
                • Size 1.2MB
                • SHA256 b17d4d842b763aa72f608f40718054441493df2581e8fe0e5ca4e617c16da097
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcB37D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcB37D.tmp
                • Size 934KB
                • SHA256 99c01493d9b23d6a9b653a7906395adc1b6be058d45821636a61469918cad867
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC2A3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC2A3.tmp
                • Size 257KB
                • SHA256 5e639edccd1ec968c4506b8e006221cdeca39a732a75c0bff1484053b9283377
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC2D5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC2D5.tmp
                • Size 2.4MB
                • SHA256 1379bd2256babe20dadbb360e54c1144822229e2e64c0cab665384cb2e351464
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC624.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC624.tmp
                • Size 524KB
                • SHA256 92f8c1ed32a062ba43da05b280568169cdebccafde37b82ba9955e7f3b4b4405
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC637.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC637.tmp
                • Size 290KB
                • SHA256 6a487d52c079c85a541ed9ed6118764db3bf9456aac2c9d397b224c3f85af69a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC649.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC649.tmp
                • Size 4.3MB
                • SHA256 2954acf0aad36f46e89162f712f63e4e78fdbea5f7941e7ee15e034144f3333d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcC65C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcC65C.tmp
                • Size 602KB
                • SHA256 206ef67199bff4fd395f6eaf9947dc20b9e41f1046be8ff832167e8e651f3811
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcCC1C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcCC1C.tmp
                • Size 23.7MB
                • SHA256 760989016ca6c13cbca4b6b2dab3a1d9c7728fbda6669261b3cead66bc17a012
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcDC35.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcDC35.tmp
                • Size 822KB
                • SHA256 9c047868a9ed26ffc0a56b1036da214c2118f13274fedaae20bc3a7d0338e927
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcE8FA.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcE8FA.tmp
                • Size 500KB
                • SHA256 36e55a3f13b7ad2d807b69a0d08bb91164c5b75c267af8dbe9f4036ab92c2cea
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcE92C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcE92C.tmp
                • Size 329KB
                • SHA256 3b37d28b498761b2e23be352b462971b8871dbd02b9f1d15f73d6cddc200895d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcE94E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcE94E.tmp
                • Size 233KB
                • SHA256 ffc8cd1e239b2eca9c5c16441e1d59d71fade53ba8d694c20292d19470240197
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF60E.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF60E.tmp
                • Size 386KB
                • SHA256 f0b93639630996b577c5057b54888ae02208cb034bb799a80ef7120675dacc1a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/4004-72-0x0000000000400000-0x000000000044A000-memory.dmp
                Download

                memory/4004-134-0x0000000000400000-0x000000000044A000-memory.dmp
                Download

                memory/4964-145-0x0000000000400000-0x000000000044A000-memory.dmp
                Download