Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
30/06/2026, 11:15
General
- Target 2026-06-29_31c41894fc7a642c8dcbfad949dcce31_amadey_darkgate_elex_glassworm_smoke-loader.exe
- Size 50.7MB
- Sample260630-ncsrasdw2x
- SHA256 e63baa636f66a0ba3d77ffbaa3819b9e0ec39578f87a6e726b1aa04426b41877
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_31c41894fc7a642c8dcbfad949dcce31_amadey_darkgate_elex_glassworm_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_31c41894fc7a642c8dcbfad949dcce31_amadey_darkgate_elex_glassworm_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3672-0-0x0000000000400000-0x000000000551A000-memory.dmp
memory/3672-1-0x0000000010000000-0x0000000010323000-memory.dmp
memory/3672-6-0x0000000005C60000-0x0000000005C61000-memory.dmp
memory/3672-5-0x0000000005C50000-0x0000000005C51000-memory.dmp
memory/3672-8-0x0000000007920000-0x0000000007921000-memory.dmp
memory/3672-7-0x0000000007930000-0x0000000007931000-memory.dmp
memory/3672-13-0x0000000009370000-0x0000000009371000-memory.dmp
memory/3672-12-0x0000000009330000-0x0000000009331000-memory.dmp
memory/3672-11-0x00000000092B0000-0x00000000092B1000-memory.dmp
memory/3672-10-0x0000000009240000-0x0000000009241000-memory.dmp
memory/3672-9-0x0000000009200000-0x0000000009201000-memory.dmp
memory/3672-14-0x0000000009270000-0x0000000009271000-memory.dmp
memory/3672-15-0x0000000000400000-0x000000000551A000-memory.dmp
memory/3672-19-0x00000000091D0000-0x00000000091D1000-memory.dmp
memory/3672-16-0x0000000009120000-0x0000000009121000-memory.dmp
memory/3672-17-0x0000000009160000-0x0000000009161000-memory.dmp
memory/3672-18-0x0000000009190000-0x0000000009191000-memory.dmp
memory/3672-23-0x0000000009310000-0x0000000009311000-memory.dmp
memory/3672-22-0x0000000009250000-0x0000000009251000-memory.dmp
memory/3672-21-0x0000000009170000-0x0000000009171000-memory.dmp
memory/3672-20-0x0000000007950000-0x0000000007951000-memory.dmp