Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 01:50
General
- Target 2026-06-27_e672af1916c30fb2fcf13e41f3fae690_darkgate_elex_gcleaner_glassworm_helldown.exe
- Size 8.3MB
- Sample260629-b9f3jsax3x
- SHA256 05c877e57b25c37e75b8c2a07a5f0ecc31e3b1bb8d12aeb9554c93dcde4ce621
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 7 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_e672af1916c30fb2fcf13e41f3fae690_darkgate_elex_gcleaner_glassworm_helldown.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e672af1916c30fb2fcf13e41f3fae690_darkgate_elex_gcleaner_glassworm_helldown.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5732-0-0x00000000015DD000-0x00000000015DE000-memory.dmp
memory/5732-1-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-5-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-6-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-7-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-8-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-9-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-11-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-14-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-16-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-17-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-19-0x0000000000EE0000-0x000000000175A000-memory.dmp
memory/5732-20-0x0000000000EE0000-0x000000000175A000-memory.dmp