264a0cb9df2ec3b72bee7c1d1c442ae5cda086973dffc1f36008cf847644fe52

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe
Size 7.3MB
Sample260701-ltxepsds6x
SHA256 264a0cb9df2ec3b72bee7c1d1c442ae5cda086973dffc1f36008cf847644fe52
MD5 52e7150e67f03332519c36bdcda2f6f9
SHA1 7035e9d89642a5b62deff07469adada678000947
SHA512 1acd7dd8f7fcfe836aa5be3df5d76ab915c86487fb9fab282d97b7f566717e97cac422fb5cef91a8b2c2cbd5557a43b1ff00bc24e261bed3b5288a035e7e7845
SSDEEP 98304:0jMTdAsXGNiBHoakKpsNsEXbpfb9RjtG0U+08F6R8xNPHr1lC9:0jMTdAlw7kNsELtbhG0U38vJr189
TLSH
T163768E1337D18D7DE1B61AF08879A25986BAFE701B34C6DF53C4540A2A72EC6DA32353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1132	g2ax_installer_customer.exe

Loads dropped DLL 1 IoCs

pid	Process
1132	g2ax_installer_customer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	g2ax_installer_customer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5892	2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 1132	5892	2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Users\Admin\AppData\Local\Temp\Citrix\GoToAssist Express\238\g2aE3B5.tmp\g2ax_installer_customer.exe
  "C:\Users\Admin\AppData\Local\Temp\Citrix\GoToAssist Express\238\g2aE3B5.tmp\g2ax_installer_customer.exe " "/LoaderPath C:\Users\Admin\AppData\Local\Temp\2026-07-01_52e7150e67f03332519c36bdcda2f6f9_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_redl.exe" "/LogPath C:\Users\Admin\AppData\Local\Temp\CitrixLogs\GoToAssist Express\238\logE395.tmp\" "/RestartReason Start"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

g2ax_combined_customer.dll

Path C:\Users\Admin\AppData\Local\Temp\Citrix\GoToAssist Express\238\g2aE3B5.tmp\g2ax_combined_customer.dll
Size 5.8MB
SHA256 8d6196dc69cc4fe800e720a26459ba6c51ef394b0315f37fcd8243d0ca2f6005
MD5 9467b7f5f1ce9055caedd3234f29ba93
SHA1 945e8b232c3f1698f356c7c6aa9ecacbf7ddb058
SHA512 5a4f8b50238416322fad14c1ba52d437ea46c293dccc63e68b9d0f2e004402d9a353e852912a306cc5b554a32e45cd657faf51e39065f108fa05b8917b16c22f
SSDEEP 98304:iMTdAsXGNiBHoakKpsNsEXbpfb9RjtG0U+08F6R8xU:iMTdAlw7kNsELtbhG0U38vU
TLSH
T17B567D1337D18D6DE2B616F05979A21D86FAFE701B34C69F5384440A2A72EC7DA32363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g2ax_installer_customer.exe

Path C:\Users\Admin\AppData\Local\Temp\Citrix\GoToAssist Express\238\g2aE3B5.tmp\g2ax_installer_customer.exe
Size 157KB
SHA256 b7e4db098cfb4ad26d12f0bcde309f94b55b3205b658f2be8596812d52c95e82
MD5 3372729a22b51092203fbe63bdd93e98
SHA1 399b34916632ecf9fb388afba7c8d96bea5dab28
SHA512 a0d63a42085870940aa1c2e060f660dad91c4348a3eded0938056c5af6da354d5ca590d4ed8859bc555401b3b9ac38afc01d6784e0793ad9b599fa4a621f57cf
SSDEEP 3072:3ABrmfPHblNFT0+BfUVanyNABrmfPHblNFT0+BfUVanyWS+:3Alm3blNFo+BfUVaaAlm3blNFo+BfUVS
TLSH
T171F3D059BB16C064DA654D70D5FBD1F40A3E3E42CD8052D73888BF173F31E94AAA1ACA
MD5 SHA1 SHA512 SSDEEP TLSH