Analysis
- max time kernel
122s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/10/2026, 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
35 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe
- Size 4.1MB
- Sample261018-sw9ldabe89
- SHA256 d49bb02efbe38be006e1e4bb2465a472a85adb806fd898d2d86eae5f82cd6c02
- MD5 3f3b49ffaf6ec0d04cc8e4870916c5e7
- SHA1 2cdf3052f894e5c72f00c4f6bf1e0510923985cf
- SHA512 75a5ba272b2e6824edf8958db6ef8cf23256422eb52e262efa6ce240031d0dd7f776e7c1e49dd1f9fed5b02264b89e5af5bcc918744943c9bd110fc1072772ee
- SSDEEP 49152:pCwsbCANeKXferL7Vwe/Gg0P+WhzuyBPtoP9QnlSU6eqVUcGrG:Ews2ANeKXOaeOgmhzu4Py2nlSU6eqFt
- TLSH T173169E0375928432D3958671EDBB9AB397257E7D07F201EBB348BDD936326C03A36225
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
-
resource yara_rule behavioral1/memory/1324-45-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1324-44-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2624-55-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2624-56-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2396-74-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2396-80-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2396-84-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit - Gh0st RAT payload 9 IoCs
resource yara_rule behavioral1/files/0x001900000001e58d-12.dat family_gh0strat behavioral1/memory/5000-27-0x0000000000400000-0x00000000004EE000-memory.dmp family_gh0strat behavioral1/memory/1324-45-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1324-44-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2624-55-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2624-56-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2396-74-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2396-80-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2396-84-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral1/memory/3924-1-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-4-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-3-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-24-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-25-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-21-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-16-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-15-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-8-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-49-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-48-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-73-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-94-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-95-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-97-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-98-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-99-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-101-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-103-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-105-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-107-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/files/0x000700000002438b-113.dat INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-114-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-116-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-118-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-119-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-124-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-122-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-125-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-126-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-133-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-135-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-137-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-140-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-139-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-143-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-145-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-147-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3924-151-0x00000000025F0000-0x000000000367E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 50 IoCs
resource yara_rule behavioral1/memory/3924-1-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-4-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-3-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-26-0x0000000000400000-0x00000000006E1000-memory.dmp UPX behavioral1/memory/3924-24-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-25-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/1324-40-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/3924-21-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-16-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-15-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-8-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/1324-45-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/3924-49-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-48-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/1324-44-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2624-55-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2624-53-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2624-56-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2396-74-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/2396-80-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/3924-73-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/2396-84-0x0000000010000000-0x00000000101B6000-memory.dmp UPX behavioral1/memory/3924-94-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-95-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-97-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-98-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-99-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-101-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-102-0x0000000000400000-0x00000000006E1000-memory.dmp UPX behavioral1/memory/3924-103-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-105-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-107-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-114-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-116-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-118-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-119-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-124-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-122-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-125-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-126-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-133-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-135-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-137-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-140-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-139-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-143-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-145-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-147-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-151-0x00000000025F0000-0x000000000367E000-memory.dmp UPX behavioral1/memory/3924-171-0x0000000000400000-0x00000000006E1000-memory.dmp UPX - Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\QAssist.sys TXPlatfor.exe - Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Remote Data\Parameters\ServiceDll = "C:\\Windows\\system32\\240696546.txt" R.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatfor.exe - Executes dropped EXE 6 IoCs
pid Process 5000 R.exe 1324 N.exe 2624 TXPlatfor.exe 1832 HD_2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 2396 TXPlatfor.exe 1112 Remote Data.exe - Loads dropped DLL 3 IoCs
pid Process 5000 R.exe 1972 svchost.exe 1112 Remote Data.exe - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\G: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\M: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\Q: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\Z: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\N: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\P: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\S: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\W: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\X: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\Y: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\I: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\R: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\T: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\H: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\J: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\K: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\L: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\O: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\U: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened (read-only) \??\V: 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification F:\autorun.inf 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\240696546.txt R.exe File opened for modification C:\Windows\SysWOW64\ini.ini R.exe File created C:\Windows\SysWOW64\Remote Data.exe svchost.exe File opened for modification C:\Windows\SysWOW64\Remote Data.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatfor.exe N.exe File opened for modification C:\Windows\SysWOW64\TXPlatfor.exe N.exe -
resource yara_rule behavioral1/memory/3924-1-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-4-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-3-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-24-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-25-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/1324-40-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3924-21-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-16-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-15-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-8-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/1324-45-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3924-49-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-48-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/1324-44-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2624-55-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2624-53-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2624-56-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2396-74-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2396-80-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3924-73-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/2396-84-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/3924-94-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-95-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-97-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-98-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-99-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-101-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-103-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-105-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-107-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-114-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-116-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-118-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-119-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-124-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-122-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-125-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-126-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-133-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-135-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-137-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-140-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-139-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-143-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-145-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-147-0x00000000025F0000-0x000000000367E000-memory.dmp upx behavioral1/memory/3924-151-0x00000000025F0000-0x000000000367E000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3860 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname TXPlatfor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain TXPlatfor.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Remote Data.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Remote Data.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language R.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HD_2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TXPlatfor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Remote Data.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3860 cmd.exe 3560 PING.EXE - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3560 PING.EXE - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2396 TXPlatfor.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe Token: SeDebugPrivilege 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 5000 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 85 PID 3924 wrote to memory of 792 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 9 PID 3924 wrote to memory of 796 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 10 PID 3924 wrote to memory of 440 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 14 PID 3924 wrote to memory of 2788 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 47 PID 3924 wrote to memory of 2860 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 48 PID 3924 wrote to memory of 3036 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 53 PID 3924 wrote to memory of 3328 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 56 PID 3924 wrote to memory of 3468 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 57 PID 3924 wrote to memory of 3664 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 58 PID 3924 wrote to memory of 3748 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 59 PID 3924 wrote to memory of 3824 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 60 PID 3924 wrote to memory of 3912 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 61 PID 3924 wrote to memory of 1528 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 62 PID 3924 wrote to memory of 4516 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 65 PID 3924 wrote to memory of 2604 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 77 PID 3924 wrote to memory of 5000 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 85 PID 3924 wrote to memory of 5000 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 85 PID 3924 wrote to memory of 1324 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 89 PID 3924 wrote to memory of 792 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 9 PID 3924 wrote to memory of 796 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 10 PID 3924 wrote to memory of 440 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 14 PID 3924 wrote to memory of 2788 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 47 PID 3924 wrote to memory of 2860 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 48 PID 3924 wrote to memory of 3036 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 53 PID 3924 wrote to memory of 3328 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 56 PID 3924 wrote to memory of 3468 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 57 PID 3924 wrote to memory of 3664 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 58 PID 3924 wrote to memory of 3748 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 59 PID 3924 wrote to memory of 3824 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 60 PID 3924 wrote to memory of 3912 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 61 PID 3924 wrote to memory of 1528 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 62 PID 3924 wrote to memory of 4516 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 65 PID 3924 wrote to memory of 2604 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 77 PID 3924 wrote to memory of 1324 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 89 PID 3924 wrote to memory of 1324 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 89 PID 1324 wrote to memory of 3860 1324 N.exe 92 PID 3924 wrote to memory of 1832 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 93 PID 2624 wrote to memory of 2396 2624 TXPlatfor.exe 94 PID 1972 wrote to memory of 1112 1972 svchost.exe 96 PID 3860 wrote to memory of 3560 3860 cmd.exe 101 PID 3924 wrote to memory of 792 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 9 PID 3924 wrote to memory of 796 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 10 PID 3924 wrote to memory of 440 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 14 PID 3924 wrote to memory of 2788 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 47 PID 3924 wrote to memory of 2860 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 48 PID 3924 wrote to memory of 3036 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 53 PID 3924 wrote to memory of 3328 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 56 PID 3924 wrote to memory of 3468 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 57 PID 3924 wrote to memory of 3664 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 58 PID 3924 wrote to memory of 3748 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 59 PID 3924 wrote to memory of 3824 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 60 PID 3924 wrote to memory of 3912 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 61 PID 3924 wrote to memory of 1528 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 62 PID 3924 wrote to memory of 4516 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 65 PID 3924 wrote to memory of 2604 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 77 PID 3924 wrote to memory of 792 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 9 PID 3924 wrote to memory of 796 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 10 PID 3924 wrote to memory of 440 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 14 PID 3924 wrote to memory of 2788 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 47 PID 3924 wrote to memory of 2860 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 48 PID 3924 wrote to memory of 3036 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 53 PID 3924 wrote to memory of 3328 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 56 PID 3924 wrote to memory of 3468 3924 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe 57 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:440
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2860
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:3036
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\R.exeC:\Users\Admin\AppData\Local\Temp\\R.exe3⤵
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5000
-
-
C:\Users\Admin\AppData\Local\Temp\N.exeC:\Users\Admin\AppData\Local\Temp\\N.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\N.exe > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3560
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\HD_2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exeC:\Users\Admin\AppData\Local\Temp\HD_2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3468
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3664
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3748
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3824
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1528
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4516
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2604
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵PID:4832
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Remote Data"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\Remote Data.exe"C:\Windows\system32\Remote Data.exe" "c:\windows\system32\240696546.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:1112
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k "Remote Data"1⤵PID:4208
-
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -auto1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\TXPlatfor.exeC:\Windows\SysWOW64\TXPlatfor.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: LoadsDriver
PID:2396
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\HD_2026-10-18_3f3b49ffaf6ec0d04cc8e4870916c5e7_darkgate_elex_emotet_glassworm_remcos_wannacry.exe
- Size 1.3MB
- SHA256 29d4ff8a6df10f239b5b0c489d456a2d8d456fa218ef5ff8edb1f47aa0e5968f
- MD5 7de7197ce0d7dbc36da687bf9c527e91
- SHA1 ef29a518467d0eb700ab2094cc7a5b413500a33f
- SHA512 aa0a131e671a097863fe458ae9f227e7e0966efab21b91a517fc9ce2caedf322a70df3e5d7449801a188fa365910de99b1686140a2c772923782e2eb3c8dfe52
- SSDEEP 24576:4AzdWn0Gnz8HPQ4MIBPznuLGQm9DU6epYsmew8aQcGG6q/KC0DRkR:RQnlSU6eqVUcGrG
- TLSH T1D2557E213947C135F2B28171A8BEBB6A95BE7D640B7140C7A380792E49137D23E37B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
- Size 2.7MB
- SHA256 cd92075881aadf3875c3fee74d8716dc248465773978423eebd86aaca168c7d2
- MD5 2f87770026a209b5dfc23e18590e487e
- SHA1 b14cd22ea92b83d9620689d33595dcef993f4e52
- SHA512 539c684236fc9b8aa23e8f763d660a2b9c7374540328ec8407a228793774291dd84e317f38b0cf86dfdc923aaf5b404a3aa91002d521e1b7a327c3739d6faad1
- SSDEEP 49152:uCwsbCANnKXferL7Vwe/Gg0P+WhzuyBPtoq:Jws2ANnKXOaeOgmhzu4Pyq
- TLSH T152D59E47B5914862C3C88A72EE67D9B39B207EBE57F3053AB75CBDC836357047A21224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\N.exe
- Size 377KB
- SHA256 3de6c02f52a661b8f934f59541d0cf297bb489eb2155e346b63c7338e09aeaf8
- MD5 4a36a48e58829c22381572b2040b6fe0
- SHA1 f09d30e44ff7e3f20a5de307720f3ad148c6143b
- SHA512 5d0ea398792f6b9eb3f188813c50b7f43929183b5733d2b595b2fd1c78722764fd15f62db1086b5c7edfb157661a6dcd544ddd80907ee7699dddbca1ef4022d0
- SSDEEP 6144:5UGp2l6zRmeVLNHfkQ2TAygOcqAJwQZgb4YtjH6/MuQafORzEOmFfMzi71o+YHL7:HclcceBKlKwAg0Mja/UafOVwbha
- TLSH T152841241FF520127C74AB0B5C9984E7F8E7A03888E650C3A7F795E4E1B603EE6923D59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\R.exe
- Size 941KB
- SHA256 bc29f2022ab3b812e50c8681ff196f090c038b5ab51e37daffac4469a8c2eb2c
- MD5 8dc3adf1c490211971c1e2325f1424d2
- SHA1 4eec4a4e7cb97c5efa6c72e0731cd090c0c4adc5
- SHA512 ae92ea20b359849dcdba4808119b154e3af5ef3687ee09de1797610fe8c4d3eb9065b068074d35adddb4b225d17c619baff3944cb137ad196bcef7a6507f920d
- SSDEEP 24576:N+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nH1PXw:cerL7Vw
- TLSH T105257D43E6765C93C3CC4836CC7AD27273217A5CB3F79636B180AAD7B6B52603D2065A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\winljhslx.exe
- Size 81KB
- SHA256 c1f776192eb216fe9caae9d908ee5dc710bc88c809e63e681e7be92ecdf47d27
- MD5 02ef775cd8dfc855c6a26b2db357af23
- SHA1 810f5f2dd31e93f1df6497f5374de2fb0b6e789a
- SHA512 ffe822f20509fefbce17e6844053a9b868fb3641f6440c5aa8aa21a0a1f8e8339ef17b9e8448fdcbd3a324db3bce83f4aa7da3326b119a535b47d098f05ca84a
- SSDEEP 1536:H8fcdTzEgLlyDAwuL+NQQxJKJU43dqNKEjGT+HvDybDuL6DXc1bNAgZ:c8Ighy8wuL+yQxJKJJdqNwT+iDMjR
- TLSH T15A83026F2C110C65E83DD6FA8AB047F78F990655F5297120059BCE0FD43A8D9EE00EEA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\240696546.txt
- Size 899KB
- SHA256 a44a9a43e00420f861cf890cb22f65f33ae9abb9a2fdb4921f5611c6f9d7da9a
- MD5 4ce25a72e11af5d0ac124024b4c7dfe7
- SHA1 57ea725110116653bda52a098456a1bc253495cd
- SHA512 059f761514e1fcd9a90affb7e313afcb575ef3dd40aca25d093da7aa912c3549870a6c76bbee442a5f5aede87e69a62b15984419fef987d0e26267de632b60d6
- SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXs:7wqd87Vs
- TLSH T179152983F6B68CA3C7C90435DC7AD2B67B24761CE3F786327280E9D7B5B6251781421A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Remote Data.exe
- Size 60KB
- SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
- MD5 889b99c52a60dd49227c5e485a016679
- SHA1 8fa889e456aa646a4d0a4349977430ce5fa5e2d7
- SHA512 08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641
- SSDEEP 1536:H9ykYCTdiHQKrFXmw2RQln5IUmDjoX6+:HlMHprF2nRQln5I
- TLSH T127532AC2FA00C171D4A7563019778F1A5766AC13DB728ACB94B0B4A41EB3291AD3E5FF
- MD5 SHA1 SHA512 SSDEEP TLSH