Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 04:31
General
- Target 2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe
- Size 14.0MB
- Sample260629-e5sgkac15w
- SHA256 4a465658121a15449fadbeed82d37c461e601ae45c08a3d6c992285d31ebf804
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a040670ccbe6b4c9841d8706c433997c_acrstealer_amadey_coinminer_darkgate_elex_gcleaner_glass.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 5922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2412 -ip 24121⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-0-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-4-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-9-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-7-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-6-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-11-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-15-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-23-0x00000000FF020000-0x00000000FF021000-memory.dmp
memory/2412-1499-0x00000000FF1C0000-0x00000000FF1C5000-memory.dmp
memory/2412-1528-0x00000000040E0000-0x00000000040E1000-memory.dmp
memory/2412-1527-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/2412-1526-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/2412-1525-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/2412-1524-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/2412-1523-0x00000000040B0000-0x00000000040B1000-memory.dmp
memory/2412-1522-0x00000000040B0000-0x00000000040B1000-memory.dmp
memory/2412-1521-0x0000000003F90000-0x0000000003F91000-memory.dmp
memory/2412-1518-0x0000000003F80000-0x0000000003F81000-memory.dmp
memory/2412-1516-0x0000000003F70000-0x0000000003F71000-memory.dmp
memory/2412-1504-0x0000000003F00000-0x0000000003F01000-memory.dmp
memory/2412-1549-0x0000000004180000-0x0000000004181000-memory.dmp
memory/2412-1548-0x0000000004180000-0x0000000004181000-memory.dmp
memory/2412-1547-0x0000000004170000-0x0000000004171000-memory.dmp
memory/2412-1555-0x00000000041B0000-0x00000000041B1000-memory.dmp
memory/2412-1546-0x0000000004170000-0x0000000004171000-memory.dmp
memory/2412-1558-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/2412-1557-0x00000000041C0000-0x00000000041C1000-memory.dmp
memory/2412-1622-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1556-0x00000000041C0000-0x00000000041C1000-memory.dmp
memory/2412-1554-0x00000000041B0000-0x00000000041B1000-memory.dmp
memory/2412-1646-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1553-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/2412-1651-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1552-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/2412-1551-0x0000000004190000-0x0000000004191000-memory.dmp
memory/2412-1550-0x0000000004190000-0x0000000004191000-memory.dmp
memory/2412-1545-0x0000000004160000-0x0000000004161000-memory.dmp
memory/2412-1544-0x0000000004160000-0x0000000004161000-memory.dmp
memory/2412-1543-0x0000000004150000-0x0000000004151000-memory.dmp
memory/2412-1687-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1542-0x0000000004150000-0x0000000004151000-memory.dmp
memory/2412-1716-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1751-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1541-0x0000000004140000-0x0000000004141000-memory.dmp
memory/2412-1782-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1540-0x0000000004140000-0x0000000004141000-memory.dmp
memory/2412-1539-0x0000000004130000-0x0000000004131000-memory.dmp
memory/2412-1538-0x0000000004130000-0x0000000004131000-memory.dmp
memory/2412-1537-0x0000000004120000-0x0000000004121000-memory.dmp
memory/2412-1536-0x0000000004120000-0x0000000004121000-memory.dmp
memory/2412-1535-0x0000000004110000-0x0000000004111000-memory.dmp
memory/2412-1534-0x0000000004110000-0x0000000004111000-memory.dmp
memory/2412-1903-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1871-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1533-0x0000000004100000-0x0000000004101000-memory.dmp
memory/2412-1532-0x0000000004100000-0x0000000004101000-memory.dmp
memory/2412-1531-0x00000000040F0000-0x00000000040F1000-memory.dmp
memory/2412-1530-0x00000000040F0000-0x00000000040F1000-memory.dmp
memory/2412-1529-0x00000000040E0000-0x00000000040E1000-memory.dmp
memory/2412-1520-0x0000000003F90000-0x0000000003F91000-memory.dmp
memory/2412-1519-0x0000000003F80000-0x0000000003F81000-memory.dmp
memory/2412-1517-0x0000000003F70000-0x0000000003F71000-memory.dmp
memory/2412-1515-0x0000000003F60000-0x0000000003F61000-memory.dmp
memory/2412-1514-0x0000000003F60000-0x0000000003F61000-memory.dmp
memory/2412-1513-0x0000000003F50000-0x0000000003F51000-memory.dmp
memory/2412-1512-0x0000000003F50000-0x0000000003F51000-memory.dmp
memory/2412-1511-0x0000000003F30000-0x0000000003F31000-memory.dmp
memory/2412-1510-0x0000000003F30000-0x0000000003F31000-memory.dmp
memory/2412-1509-0x0000000003F20000-0x0000000003F21000-memory.dmp
memory/2412-1508-0x0000000003F20000-0x0000000003F21000-memory.dmp
memory/2412-2110-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2606-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-4178-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-4170-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-4184-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2567-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2540-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2582-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2574-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-2105-0x00000000027D0000-0x00000000027FC000-memory.dmp
memory/2412-1507-0x0000000003F10000-0x0000000003F11000-memory.dmp
memory/2412-1506-0x0000000003F10000-0x0000000003F11000-memory.dmp
memory/2412-1505-0x0000000003F00000-0x0000000003F01000-memory.dmp