Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 04:31
General
- Target 2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe
- Size 14.0MB
- Sample260629-e5sgkac15w
- SHA256 4a465658121a15449fadbeed82d37c461e601ae45c08a3d6c992285d31ebf804
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4532 -ip 45321⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4532-0-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-15-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-11-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-9-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-7-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-6-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-4-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-1-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-23-0x00000000FF320000-0x00000000FF321000-memory.dmp
memory/4532-1499-0x00000000FF4B0000-0x00000000FF4B5000-memory.dmp
memory/4532-1505-0x00000000037E0000-0x00000000037E1000-memory.dmp
memory/4532-1504-0x00000000037E0000-0x00000000037E1000-memory.dmp
memory/4532-1507-0x00000000037F0000-0x00000000037F1000-memory.dmp
memory/4532-1506-0x00000000037F0000-0x00000000037F1000-memory.dmp
memory/4532-1509-0x0000000003800000-0x0000000003801000-memory.dmp
memory/4532-1508-0x0000000003800000-0x0000000003801000-memory.dmp
memory/4532-1511-0x0000000003810000-0x0000000003811000-memory.dmp
memory/4532-1510-0x0000000003810000-0x0000000003811000-memory.dmp
memory/4532-1513-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4532-1512-0x0000000003830000-0x0000000003831000-memory.dmp
memory/4532-1515-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4532-1514-0x0000000003840000-0x0000000003841000-memory.dmp
memory/4532-1517-0x0000000003850000-0x0000000003851000-memory.dmp
memory/4532-1516-0x0000000003850000-0x0000000003851000-memory.dmp
memory/4532-1519-0x0000000003860000-0x0000000003861000-memory.dmp
memory/4532-1518-0x0000000003860000-0x0000000003861000-memory.dmp
memory/4532-1521-0x0000000003870000-0x0000000003871000-memory.dmp
memory/4532-1520-0x0000000003870000-0x0000000003871000-memory.dmp
memory/4532-1523-0x0000000003880000-0x0000000003881000-memory.dmp
memory/4532-1522-0x0000000003880000-0x0000000003881000-memory.dmp
memory/4532-1525-0x0000000003890000-0x0000000003891000-memory.dmp
memory/4532-1524-0x0000000003890000-0x0000000003891000-memory.dmp
memory/4532-1527-0x00000000038A0000-0x00000000038A1000-memory.dmp
memory/4532-1528-0x00000000038B0000-0x00000000038B1000-memory.dmp
memory/4532-1536-0x00000000038F0000-0x00000000038F1000-memory.dmp
memory/4532-1535-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/4532-1534-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/4532-1533-0x00000000038D0000-0x00000000038D1000-memory.dmp
memory/4532-1532-0x00000000038D0000-0x00000000038D1000-memory.dmp
memory/4532-1531-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/4532-1537-0x00000000038F0000-0x00000000038F1000-memory.dmp
memory/4532-1530-0x00000000038C0000-0x00000000038C1000-memory.dmp
memory/4532-1529-0x00000000038B0000-0x00000000038B1000-memory.dmp
memory/4532-1526-0x00000000038A0000-0x00000000038A1000-memory.dmp
memory/4532-1558-0x00000000039A0000-0x00000000039A1000-memory.dmp
memory/4532-1557-0x0000000003990000-0x0000000003991000-memory.dmp
memory/4532-1556-0x0000000003990000-0x0000000003991000-memory.dmp
memory/4532-1973-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-2328-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-3095-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-3578-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-4049-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-4214-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-2711-0x0000000001FB0000-0x0000000001FDC000-memory.dmp
memory/4532-1555-0x0000000003980000-0x0000000003981000-memory.dmp
memory/4532-1554-0x0000000003980000-0x0000000003981000-memory.dmp
memory/4532-1553-0x0000000003970000-0x0000000003971000-memory.dmp
memory/4532-1552-0x0000000003970000-0x0000000003971000-memory.dmp
memory/4532-1551-0x0000000003960000-0x0000000003961000-memory.dmp
memory/4532-1550-0x0000000003960000-0x0000000003961000-memory.dmp
memory/4532-1549-0x0000000003950000-0x0000000003951000-memory.dmp
memory/4532-1548-0x0000000003950000-0x0000000003951000-memory.dmp
memory/4532-1547-0x0000000003940000-0x0000000003941000-memory.dmp
memory/4532-1546-0x0000000003940000-0x0000000003941000-memory.dmp
memory/4532-1545-0x0000000003930000-0x0000000003931000-memory.dmp
memory/4532-1544-0x0000000003930000-0x0000000003931000-memory.dmp
memory/4532-1543-0x0000000003920000-0x0000000003921000-memory.dmp
memory/4532-1542-0x0000000003920000-0x0000000003921000-memory.dmp
memory/4532-1541-0x0000000003910000-0x0000000003911000-memory.dmp
memory/4532-1540-0x0000000003910000-0x0000000003911000-memory.dmp
memory/4532-1539-0x0000000003900000-0x0000000003901000-memory.dmp
memory/4532-1538-0x0000000003900000-0x0000000003901000-memory.dmp