Analysis
- max time kernel
40s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 10:02
Behavioral task
behavioral1
Sample
2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
28 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe
- Size 1.1MB
- Sample260925-l2ymqstemd
- SHA256 1f28a19955315b9ef72c712e2dcd6dc5486fd15a98e196a8ae82e1721302c7f6
- MD5 50b9a57f2db5a33092bc404b6cdafcf2
- SHA1 c49e95e1a0ba506290f8400ce8d368bfef97de63
- SHA512 dca676fe599832e25881cb53143edc55bcadb317f8de30bf99ef7952cbec997172045199b3aa040b2e56b1e0b62d34ce5434e4daa649eda66acaf8e03e97e1c8
- SSDEEP 24576:YnsJ39LyjbJkQFMhmC+6GD9xE2P96GbuPTD:YnsHyjtk2MYC5GDlSD
- TLSH T17D359E22B2D1C433D1321A388C5B93B4983ABE512F3479CB7BE92E5C5F396C16935297
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Synaptics.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_Synaptics.exe - Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_Synaptics.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 44 IoCs
resource yara_rule behavioral1/memory/4212-129-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4212-142-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4212-140-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4212-136-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4212-137-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4212-145-0x0000000000AB0000-0x0000000001B6A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-269-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-266-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-272-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-271-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-274-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-275-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-310-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-276-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-273-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-270-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4188-268-0x0000000000B70000-0x0000000001C2A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-354-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-356-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-364-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-357-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-365-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-362-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-363-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-355-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-353-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-352-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-394-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-395-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-396-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-397-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-398-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-402-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-403-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-404-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-406-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-407-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-409-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-414-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-415-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-417-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-419-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-421-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3608-423-0x0000000006180000-0x000000000723A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 48 IoCs
resource yara_rule behavioral1/memory/4212-129-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4212-132-0x0000000000400000-0x0000000000459000-memory.dmp UPX behavioral1/memory/4212-142-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4212-149-0x0000000000400000-0x0000000000459000-memory.dmp UPX behavioral1/memory/4212-140-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4212-136-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4212-137-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4212-145-0x0000000000AB0000-0x0000000001B6A000-memory.dmp UPX behavioral1/memory/4188-269-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-266-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-272-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-271-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-274-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-275-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-310-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-276-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-273-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-270-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-268-0x0000000000B70000-0x0000000001C2A000-memory.dmp UPX behavioral1/memory/4188-319-0x0000000000400000-0x0000000000459000-memory.dmp UPX behavioral1/memory/780-320-0x0000000000400000-0x0000000000459000-memory.dmp UPX behavioral1/memory/3608-354-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-356-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-364-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-357-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-365-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-362-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-363-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-355-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-353-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-352-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-394-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-395-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-396-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-397-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-398-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-402-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-403-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-404-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-406-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-407-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-409-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-414-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-415-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-417-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-419-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-421-0x0000000006180000-0x000000000723A000-memory.dmp UPX behavioral1/memory/3608-423-0x0000000006180000-0x000000000723A000-memory.dmp UPX -
resource behavioral1/files/0x000a000000024561-377.dat - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation Synaptics.exe Key value queried \REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation Synaptics.exe - Executes dropped EXE 5 IoCs
pid Process 4212 ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe 3608 Synaptics.exe 4948 Synaptics.exe 4188 ._cache_Synaptics.exe 780 ._cache_Synaptics.exe - Windows security modification 2 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ._cache_Synaptics.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Synaptics.exe - Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: Synaptics.exe File opened (read-only) \??\I: Synaptics.exe File opened (read-only) \??\E: Synaptics.exe File opened (read-only) \??\G: Synaptics.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe File opened for modification C:\Windows\SysWOW64\._cache_Synaptics.exe Synaptics.exe -
resource yara_rule behavioral1/memory/4212-129-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4212-142-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4212-140-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4212-136-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4212-137-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4212-145-0x0000000000AB0000-0x0000000001B6A000-memory.dmp upx behavioral1/memory/4188-269-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-266-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-272-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-271-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-274-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-275-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-310-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-276-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-273-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-270-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/4188-268-0x0000000000B70000-0x0000000001C2A000-memory.dmp upx behavioral1/memory/3608-354-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-356-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-364-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-357-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-365-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-362-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-363-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-355-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-353-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-352-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-394-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-395-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-396-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-397-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-398-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-402-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-403-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-404-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-406-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-407-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-409-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-414-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-415-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-417-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-419-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-421-0x0000000006180000-0x000000000723A000-memory.dmp upx behavioral1/memory/3608-423-0x0000000006180000-0x000000000723A000-memory.dmp upx - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe File created C:\Windows\e58d4cf ._cache_Synaptics.exe File created C:\Windows\e590aa5 Synaptics.exe File created C:\Windows\e58ce28 ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Synaptics.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4404 EXCEL.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4188 ._cache_Synaptics.exe 4188 ._cache_Synaptics.exe 3608 Synaptics.exe 3608 Synaptics.exe 3608 Synaptics.exe 3608 Synaptics.exe 3608 Synaptics.exe 3608 Synaptics.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe Token: SeDebugPrivilege 4188 ._cache_Synaptics.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4404 EXCEL.EXE 4404 EXCEL.EXE 4404 EXCEL.EXE 4404 EXCEL.EXE 4404 EXCEL.EXE 4404 EXCEL.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5068 wrote to memory of 4212 5068 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe 89 PID 5068 wrote to memory of 3608 5068 2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe 91 PID 3608 wrote to memory of 4188 3608 Synaptics.exe 94 PID 4188 wrote to memory of 792 4188 ._cache_Synaptics.exe 9 PID 4188 wrote to memory of 800 4188 ._cache_Synaptics.exe 10 PID 4188 wrote to memory of 448 4188 ._cache_Synaptics.exe 14 PID 4188 wrote to memory of 2600 4188 ._cache_Synaptics.exe 51 PID 4188 wrote to memory of 1080 4188 ._cache_Synaptics.exe 52 PID 4188 wrote to memory of 2260 4188 ._cache_Synaptics.exe 53 PID 4188 wrote to memory of 3296 4188 ._cache_Synaptics.exe 56 PID 4188 wrote to memory of 3400 4188 ._cache_Synaptics.exe 57 PID 4188 wrote to memory of 3592 4188 ._cache_Synaptics.exe 58 PID 4188 wrote to memory of 3680 4188 ._cache_Synaptics.exe 59 PID 4188 wrote to memory of 3744 4188 ._cache_Synaptics.exe 60 PID 4188 wrote to memory of 3836 4188 ._cache_Synaptics.exe 61 PID 4188 wrote to memory of 3964 4188 ._cache_Synaptics.exe 62 PID 4188 wrote to memory of 4584 4188 ._cache_Synaptics.exe 65 PID 4188 wrote to memory of 1504 4188 ._cache_Synaptics.exe 76 PID 4188 wrote to memory of 2840 4188 ._cache_Synaptics.exe 83 PID 4188 wrote to memory of 3012 4188 ._cache_Synaptics.exe 84 PID 4188 wrote to memory of 4160 4188 ._cache_Synaptics.exe 87 PID 4188 wrote to memory of 5112 4188 ._cache_Synaptics.exe 88 PID 4188 wrote to memory of 3608 4188 ._cache_Synaptics.exe 91 PID 4188 wrote to memory of 3608 4188 ._cache_Synaptics.exe 91 PID 4188 wrote to memory of 3756 4188 ._cache_Synaptics.exe PID 4188 wrote to memory of 2088 4188 ._cache_Synaptics.exe 92 PID 4188 wrote to memory of 4948 4188 ._cache_Synaptics.exe 93 PID 4188 wrote to memory of 4948 4188 ._cache_Synaptics.exe 93 PID 4188 wrote to memory of 1056 4188 ._cache_Synaptics.exe 95 PID 4188 wrote to memory of 4404 4188 ._cache_Synaptics.exe 96 PID 4948 wrote to memory of 780 4948 Synaptics.exe 97 PID 3608 wrote to memory of 792 3608 Synaptics.exe 9 PID 3608 wrote to memory of 800 3608 Synaptics.exe 10 PID 3608 wrote to memory of 448 3608 Synaptics.exe 14 PID 3608 wrote to memory of 2600 3608 Synaptics.exe 51 PID 3608 wrote to memory of 1080 3608 Synaptics.exe 52 PID 3608 wrote to memory of 2260 3608 Synaptics.exe 53 PID 3608 wrote to memory of 3296 3608 Synaptics.exe 56 PID 3608 wrote to memory of 3400 3608 Synaptics.exe 57 PID 3608 wrote to memory of 3592 3608 Synaptics.exe 58 PID 3608 wrote to memory of 3680 3608 Synaptics.exe 59 PID 3608 wrote to memory of 3744 3608 Synaptics.exe 60 PID 3608 wrote to memory of 3836 3608 Synaptics.exe 61 PID 3608 wrote to memory of 3964 3608 Synaptics.exe 62 PID 3608 wrote to memory of 4584 3608 Synaptics.exe 65 PID 3608 wrote to memory of 1504 3608 Synaptics.exe 76 PID 3608 wrote to memory of 2840 3608 Synaptics.exe 83 PID 3608 wrote to memory of 3012 3608 Synaptics.exe 84 PID 3608 wrote to memory of 4160 3608 Synaptics.exe 87 PID 3608 wrote to memory of 5112 3608 Synaptics.exe 88 PID 3608 wrote to memory of 4404 3608 Synaptics.exe 96 PID 3608 wrote to memory of 792 3608 Synaptics.exe 9 PID 3608 wrote to memory of 800 3608 Synaptics.exe 10 PID 3608 wrote to memory of 448 3608 Synaptics.exe 14 PID 3608 wrote to memory of 2600 3608 Synaptics.exe 51 PID 3608 wrote to memory of 1080 3608 Synaptics.exe 52 PID 3608 wrote to memory of 2260 3608 Synaptics.exe 53 PID 3608 wrote to memory of 3296 3608 Synaptics.exe 56 PID 3608 wrote to memory of 3400 3608 Synaptics.exe 57 PID 3608 wrote to memory of 3592 3608 Synaptics.exe 58 PID 3608 wrote to memory of 3680 3608 Synaptics.exe 59 PID 3608 wrote to memory of 3744 3608 Synaptics.exe 60 PID 3608 wrote to memory of 3836 3608 Synaptics.exe 61 PID 3608 wrote to memory of 3964 3608 Synaptics.exe 62 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Synaptics.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ._cache_Synaptics.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:800
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:448
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2600
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1080
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2260
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- System policy modification
PID:4212
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4188 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1056
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3400
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3680
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3744
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3836
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3964
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4584
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1504
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:2840
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3012
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4160
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5112
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:2088
-
C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\._cache_Synaptics.exe"C:\Windows\system32\._cache_Synaptics.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:780
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4404
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Synaptics\Synaptics.exe
- Size 1.1MB
- SHA256 1f28a19955315b9ef72c712e2dcd6dc5486fd15a98e196a8ae82e1721302c7f6
- MD5 50b9a57f2db5a33092bc404b6cdafcf2
- SHA1 c49e95e1a0ba506290f8400ce8d368bfef97de63
- SHA512 dca676fe599832e25881cb53143edc55bcadb317f8de30bf99ef7952cbec997172045199b3aa040b2e56b1e0b62d34ce5434e4daa649eda66acaf8e03e97e1c8
- SSDEEP 24576:YnsJ39LyjbJkQFMhmC+6GD9xE2P96GbuPTD:YnsHyjtk2MYC5GDlSD
- TLSH T17D359E22B2D1C433D1321A388C5B93B4983ABE512F3479CB7BE92E5C5F396C16935297
- MD5 SHA1 SHA512 SSDEEP TLSH
._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe
- Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-09-24_50b9a57f2db5a33092bc404b6cdafcf2_dark-comet_darkgate_elex_gcleaner_glassworm_rhadamanthys_stop.exe
- Size 353KB
- SHA256 798a35b8810906a231df615cb6b3fcd493e88eecfd31a98f05cce06df707b726
- MD5 3234e5b897acb88de5b9852cfa12f2eb
- SHA1 a9906e2b230d9af8bdf2940c303cf01e1f853f77
- SHA512 883407a024f1cf18b65de2dcbc1a0c98cc51d6fb3ac0476d23aac77b59ea6c0c55e23ff22c21736fae75dca09e21b301aa74eb5c57c29bb731ea18daee7efbed
- SSDEEP 6144:auVMlbzm+H6G4rYENuCCpZ9n6GysxuGUaB2r9hT5c:qlm+H6G04f96GXLUQ2rjTC
- TLSH T119749D013B90C0B3D54665B00A1AC3B59EBFA4216765A1C7B7CA1F799F347D0AA3A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\M98xkjvZ.xlsm
- Size 17KB
- SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
- MD5 e566fc53051035e1e6fd0ed1823de0f9
- SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
- SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
- SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
- TLSH T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\M98xkjvZ.xlsm
- Size 20KB
- SHA256 549002e382192c535ac7005366b93d7017a2ff5dbd1c1b4813fccf9ec1e9eff4
- MD5 76e020835fae33af4a30faaa7b4535da
- SHA1 3e178136a6d1c80f89577b2afd06c25a7eef014b
- SHA512 44537a2f21abf3a0d0cdcab27133d7538f5dcd1ca9a3bcd82b45184fc258cbb3b1c994a253a923b6f39b6ffcc2b9b4b40b270b44e14fb1a0c8bc35ce06347243
- SSDEEP 384:Msya3Yep+o5bKa8X3UvC4siQ62mWX2tQt1BnX5WGxsOhM7M:MsF3/4o5bKrXaGpL2tQt1pIGxsaMI
- TLSH T13D92C039A920AE5DE222093CD10E56A5B20034C7F459AE45F5D2E6DD9A075CF23BF1CD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 f25993efa04c920e8a9557ae2397940233d95614b39a575e854a5f063555408c
- MD5 02be98ea1c1cb7ec096a7e44e82ba2b3
- SHA1 371e3e35d91226384eb125a0dc602a31992752c8
- SHA512 6bd55a9070a0aba4cbb1402b8eb72341f83de9ca5c5200de74c877c4a6f3d2119145b27eaec9c68a58aa499105391e01a7f32ffdc6af4314384dc448ca25830e
- TLSH T1E2D05E0E4BDD11AD9442002E3178D0C272399F51EC720F5C50396741642D6D9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\dhdi.exe
- Size 97KB
- SHA256 971fa572a354adc457fe27becdcc055fbb65fed83d214789d290c27133051de9
- MD5 30b5c94a97136abe590b4cf356c1b329
- SHA1 8cdfc476b60d24e656ee887819cb2b459bd6cec4
- SHA512 5aadc0efd15a41b3adad7958d5fc63535f7f4796ab547e2ca44ffa93cf83682c6738578e2487b14d2b7f64dd9ecddfa9465e665380b0f7c4e133c4c03ca10c36
- SSDEEP 1536:VdwN3ua9R7bMMBtUFzjCfYnw03/iBHkhbJ/uoUOTL+PHZyN:E+a9R7nwfBviRmYkTiPZ
- TLSH T159A30202D4901653D12E493E27CCD58B9A2F349DCE6EE689E05EB5B33D1371BB9CC0A9
- MD5 SHA1 SHA512 SSDEEP TLSH