Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 13:20
General
- Target 2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe
- Size 11.5MB
- Sample260710-qk7arscs61
- SHA256 8cf2ef8c02fac3a4637fd8bd75c44ff3390e95aa26f68c3acbe70de10cdeb86a
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\3ED80E73E13C478CA4D8E1379F6F9419.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
F:\996m2\2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe"F:/996m2/2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3ED80E73E13C478CA4D8E1379F6F9419.bat
Áú»êÕ½¼Í.ini
2026-07-10_f77eb5a864a500a193a0a33b0464904e_acrstealer_amadey_darkgate_elex_gcleaner_glassworm_helld.exe
Game.exe
game.dat
libcrypto-1_1.dll
libcurl.dll
libssl-1_1.dll
mod_fgcq.zip
msvcp100.dll
msvcp110.dll
msvcp120.dll
msvcp140.dll
msvcr100.dll
msvcr110.dll
msvcr120.dll
memory/1000-16-0x0000000000400000-0x0000000000F21000-memory.dmp
memory/1000-17-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/1000-13-0x0000000002D20000-0x0000000002D21000-memory.dmp
memory/1000-104-0x0000000000400000-0x0000000000F21000-memory.dmp
memory/1000-106-0x0000000000400000-0x0000000000F21000-memory.dmp
memory/5048-0-0x0000000001270000-0x0000000001271000-memory.dmp
memory/5048-12-0x0000000000400000-0x0000000000F21000-memory.dmp