Analysis
- max time kernel
140s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 04:30
General
- Target 2026-06-27_a0ea4930c585c7c7b1bcf57e92ee729e_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
- Size 992KB
- Sample260629-e4xd5ac13z
- SHA256 adde293735cc6f820900df50ce2fa000434ad6a254bdfbb3780fe7e107803b9a
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 13 IoCs
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 37 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0ea4930c585c7c7b1bcf57e92ee729e_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a0ea4930c585c7c7b1bcf57e92ee729e_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xVeef\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xVeef\GalaxyInstaller.exe" 1460731832 "Sherlock Holmes: Nemesis - Remastered"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xVeef\GalaxySetup.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xVeef\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1460731832 /silent /game_name="Sherlock Holmes: Nemesis - Remastered"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-M7HVV.tmp\GalaxySetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-M7HVV.tmp\GalaxySetup.tmp" /SL5="$D005E,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_xVeef\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1460731832 /silent /game_name="Sherlock Holmes: Nemesis - Remastered"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x86.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FD45D8CA-407E-4683-BFD0-C346FA0B9CBE}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{FD45D8CA-407E-4683-BFD0-C346FA0B9CBE}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x86.exe" -burn.filehandle.attached=600 -burn.filehandle.self=516 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{FF7E2123-1814-469B-9C06-190352E7B18D}\.be\VC_redist.x86.exe"C:\Windows\Temp\{FF7E2123-1814-469B-9C06-190352E7B18D}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{E032AFF3-0633-4C50-8B20-3A7FBA59BD69} {712D5F6F-8C26-428E-AA70-D981D1C5E717} 10647⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x64.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{C83E10B2-362F-4C8D-94A8-AA765933C411}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{C83E10B2-362F-4C8D-94A8-AA765933C411}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-AG16V.tmp\VC_redist.x64.exe" -burn.filehandle.attached=592 -burn.filehandle.self=692 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{43E632BC-7C3F-4A61-AD37-5DC1548F3B4A}\.be\VC_redist.x64.exe"C:\Windows\Temp\{43E632BC-7C3F-4A61-AD37-5DC1548F3B4A}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{B7351938-F097-42E8-9586-DDC225AE1175} {EB739D52-0544-4FEA-909B-2D8D22B7BFBD} 48927⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=14607318322⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3724,14558479854943579534,6683559547516551771,131072 --disable-features=NetworkService --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=1413100040194232486 --mojo-platform-channel-handle=3740 /prefetch:23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --disable-threaded-scrolling --js-flags=--expose-gc --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --field-trial-handle=3724,14558479854943579534,6683559547516551771,131072 --disable-features=NetworkService --enable-blink-features=CSSBackdropFilter,AsyncClipboard --lang=en-US --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --disable-pdf-extension --disable-spell-checking --uncaught-exception-stack-size=999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=806865544442171660 --renderer-client-id=3 --mojo-platform-channel-handle=4540 /prefetch:13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe"C:\Program Files (x86)\GOG Galaxy\GalaxyClient Helper.exe" --type=gpu-process --field-trial-handle=3724,14558479854943579534,6683559547516551771,131072 --disable-features=NetworkService --disable-gpu-sandbox --use-gl=disabled --no-sandbox --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --log-severity=info --user-agent="GOGGalaxyClient/2.0.100.1 (GOG Galaxy) 83b6745cff679691b69876bc7ee33e05e5d90bda (win11 x64)" --lang=en-US --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --log-file="C:\ProgramData\GOG.com\Galaxy\logs\cef.log" --service-request-channel-token=5351134231420207466 --mojo-platform-channel-handle=5404 /prefetch:23⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:31⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
GalaxyClient.exe
PocoData.dll
PocoDataSQLite.dll
PocoFoundation.dll
PocoJSON.dll
PocoNet.dll
PocoUtil.dll
PocoXML.dll
PocoZip.dll
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
chrome_elf.dll
libcrypto-1_1.dll
libexpat.dll
pcre2-8.dll
is-M5HAS.tmp
sqlite.dll
is-HDP6G.tmp
is-L2V8S.tmp
xdelta3.dll
zlib1.dll
is-857JS.tmp
config.json
config.json
InstallerWebinstaller.log
is-6AJON.tmp
f_000008
CURRENT
MANIFEST-000001
config.json
config.json
config.json
config.json
config.json
config.json
config.json
GalaxyInstaller.exe
icon.ico
remoteconfig.json
VC_redist.x64.exe
VC_redist.x86.exe
_isdecmp.dll
botva2.dll
GalaxySetup.tmp
VC_redist.x64.exe
VC_redist.x86.exe
logo.png
wixstdba.dll
memory/2720-0-0x0000000000620000-0x0000000000719000-memory.dmp
memory/3044-1130-0x0000000000400000-0x0000000000765000-memory.dmp
memory/3044-2018-0x0000000000400000-0x0000000000765000-memory.dmp
memory/3044-2014-0x0000000000400000-0x0000000000765000-memory.dmp
memory/3044-2083-0x0000000000400000-0x0000000000765000-memory.dmp
memory/3044-1137-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
memory/3044-84-0x0000000007DC0000-0x0000000007DCD000-memory.dmp
memory/3044-2173-0x0000000000400000-0x0000000000765000-memory.dmp
memory/3044-2690-0x0000000000400000-0x0000000000765000-memory.dmp
memory/4152-1123-0x0000000000400000-0x0000000000543000-memory.dmp
memory/4152-67-0x0000000000400000-0x0000000000543000-memory.dmp
memory/4152-2691-0x0000000000400000-0x0000000000543000-memory.dmp
memory/5896-38-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-36-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-49-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-51-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-50-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-48-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-47-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-45-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-43-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-42-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-44-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-41-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-40-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-39-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-37-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-46-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-35-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-34-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-30-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-28-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-29-0x000000001F390000-0x000000001F8B8000-memory.dmp
memory/5896-27-0x000000001EC90000-0x000000001EE52000-memory.dmp
memory/5896-16-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-15-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-54-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-53-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-2697-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-14-0x00007FFD8C010000-0x00007FFD8C9B4000-memory.dmp
memory/5896-13-0x0000000000D20000-0x0000000000D40000-memory.dmp
memory/5896-12-0x00007FFD8C19F000-0x00007FFD8C1A0000-memory.dmp