Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 11:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe
- Size 2.6MB
- Sample260828-m545cswgra
- SHA256 98c184d6e52d024c6db3492d4933fa42259d2222d318821ffcaccf96a0110288
- MD5 9fe4b5df4578ed6b9d8b8b83086049ac
- SHA1 cafb8327343ce4da72d789ff44b00d773c737436
- SHA512 21b2d8c2c46ea1106c971334a7e62876a65073ae319d2c49367fb2de9d8d914d87b09c85746476885e6f4c67fd0d5c43b721e8e39f4b322174014250ddfb7607
- SSDEEP 49152:B/3QEozbKsUmjtcdPGgIwPAvUmOsZNxiRaMDvi6Hl9QO2lMo:BvlozbKsUmjtc8w4vFjijDvUt
- TLSH T116D59E21B3D19172C0B341758897A3AAA6B6BF3107358BCB77487F4D1E72AC5DA39312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File created \??\c:\Program Files\desktop.ini 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\el.txt 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Extensions.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscorrc.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\WindowsFormsIntegration.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Design.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\hu_MASCULINE.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-process-l1-1-0.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.Registry.AccessControl.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\cs\System.Windows.Forms.Design.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hans\System.Windows.Input.Manipulations.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\sw.txt 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ja-JP\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Console.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.AccessControl.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Pipes.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationTypes.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\TipRes.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\af_NEUTER.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ms_FEMININE.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-math-l1-1-0.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.SecureString.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\PresentationUI.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pl\System.Windows.Forms.Primitives.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\7z.sfx 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File created \??\c:\Program Files\Common Files\System\msadc\msdfmap.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\zh-Hant\System.Xaml.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\readme.txt 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\System\de-DE\wab32res.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.ComponentModel.Annotations.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\ReachFramework.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\nl.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.cpl 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\UIAutomationProvider.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\PresentationFramework.resources.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\ca_FEMININE.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\InkObj.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationClientSideProviders.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\System.Diagnostics.PerformanceCounter.dll 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_MASCULINE.pak 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\cy.txt 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\cs.txt 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4960 4600 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_9fe4b5df4578ed6b9d8b8b83086049ac_amadey_darkgate_elex_glassworm_smoke-loader.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 5442⤵
- Program crash
PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4600 -ip 46001⤵PID:6008
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.dll
- Size 4.4MB
- SHA256 235c016fa99c102b724c6f0d84c8aa25f5b84e8a48dab5ba67832d9ec65471b1
- MD5 4354c73f7dae3c0f675a72ee993e278d
- SHA1 1f0fae5701bcdad4b51c429ff5b411c77ebe0e82
- SHA512 d634dd6090c847a98efbbd09871e5ea541a5f05e3d41900a671ee898c124088c7453b99961f4f8c88ff8b44cad35e362abb442afca8931cf5249122cf5dcd984
- SSDEEP 49152:B/3QEozbKsUmjtcdPGgIwPAvUmOsZNxiRaMDvi6Hl9QO2lMrzTxMtpzpDBGyo:BvlozbKsUmjtc8w4vFjijDvUATgDB
- TLSH T1E1267D16F7B48171D0B3C075C593A7AAEAB17D554B3096CB2384BB2D2E33AD5CA39321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_MASCULINE.pak
- Size 23B
- SHA256 b189beaa211d90f2d81ce45beb5790fe72e9fff13dca5f46ad1461489fe59106
- MD5 b3f6ee17e4d70043651e0205fd942631
- SHA1 09659cf4c7613e3196125ecc6b491ea345993980
- SHA512 bda3d9506c22cdb0f06bc4ff08b7948530dd23dc4f39e544c604bd892ff9b73665f0bf2e7c7228e3d0fc4d72c8a285e40b71443ef57beac0df993a572626dc76
- MD5 SHA1 SHA512
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Metadata.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512