Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe
- Size 8.7MB
- Sample260930-n22eqssw2j
- SHA256 3945ecac3bb1382bfbac53b3f7d28615d3b769dfb311ce9b7a608d43c7f93998
- MD5 447c87999b3cc3ea7fca5eb30cfd559a
- SHA1 9002110ece8f0b6131d71da1c3054342bcf7259d
- SHA512 d435b4e47af304be4a43b98fdd260bbee002530061a6e464947751c73caaf4f0bdfab1b2ed18ff404693ce5f96727863e4b8a944d13db4c172c3dbfd6346512c
- SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfW1p1zYuraz1qfgIDQSoq2VjnmftS:nIcRGBfW1GBfW1pVG1qfguQSGnms
- TLSH T124967B0273E48075D0F66270857A9635A376BD211B31D7EF66887A2E7E33BC09E35362
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\Z:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\E:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\G:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\I:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\Q:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\R:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\S:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\U:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\W:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\M:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\P:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\X:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\D:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\H:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\J:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\K:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\L:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\O:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\T:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\V:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\F:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\N:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe \??\Y:\ 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4940 2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_447c87999b3cc3ea7fca5eb30cfd559a_amadey_darkgate_elex_glassworm_nymaim_ramnit_rhadamanthys_vidar_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4940
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 10.8MB
- SHA256 20617026882de81f1e3377e6e8c416a1b3a732032bb4ba255c454d6e6e2deb17
- MD5 4283e8b9eb6ef28d2f25d581350087a1
- SHA1 8c2251cd31c910339c0dbb9c6b2b7ec7ee051975
- SHA512 b242e0e7c5a4e79c0ff5fa52af84e3e80048025c0edc81459cd81f4e29b7f56ab19eed0a34e4b756a0274916173fc0589dc1c9b73186a2bda452c560d3aaf4e2
- SSDEEP 98304:CdYOXwnS4rVR5v77GBfWx77GBfW1p1zYuraz1qfgIDQSoq2Vjnmftqoq2VjnmF:nIcRGBfW1GBfW1pVG1qfguQSGnmgGnC
- TLSH T118B68D0273E880B5D0F6927485769666E372BC211B31D7EF56947A1E3E33BD09E39322
- MD5 SHA1 SHA512 SSDEEP TLSH