Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
11/07/2026, 11:16
General
- Target 2026-07-11_22d99c4dfcbd7ebbbc99b4270c08b66c_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
- Size 1.8MB
- Sample260711-ndabcaaz8x
- SHA256 82177d52d8d56a412bd3a9813901d14ce361b6d1b2477d61e818adf68257bb50
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_22d99c4dfcbd7ebbbc99b4270c08b66c_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_22d99c4dfcbd7ebbbc99b4270c08b66c_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XRFaT\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XRFaT\GalaxyInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XRFaT\GalaxySetup.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XRFaT\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvcnUvP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ni4wLjAuMCBZYUJyb3dzZXIvMjYuNC4wLjAgU2FmYXJpLzUzNy4zNiIsInVuaXF1ZV9pZCI6IjE3ODI5MjgzNjQtZHVta0p3TFY1WkRNcVd1WnlyVUdRUT09In0sImxvZ2luX3BhcmFtZXRlcnMiOiJvcmlnaW49aHR0cCUzQSUyRiUyRmdhbGF4eTItc2lnbnVwLmdvZy5wcm9kJTJGcnUlMkYlM0ZlbWJlZGRhYmxlJTNEdHJ1ZSZvcmlnaW5fdXNlcl9hZ2VudD1Nb3ppbGxhJTJGNS4wKyUyOFdpbmRvd3MrTlQrMTAuMCUzQitXaW42NCUzQit4NjQlMjkrQXBwbGVXZWJLaXQlMkY1MzcuMzYrJTI4S0hUTUwlMkMrbGlrZStHZWNrbyUyOStDaHJvbWUlMkYxNDYuMC4wLjArWWFCcm93c2VyJTJGMjYuNC4wLjArU2FmYXJpJTJGNTM3LjM2JnVuaXF1ZV9pZD0xNzgyOTI4MzY0LWR1bWtKd0xWNVpETXFXdVp5clVHUVElM0QlM0QifQ=="3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KOPD3.tmp\GalaxySetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KOPD3.tmp\GalaxySetup.tmp" /SL5="$901D2,286404590,1268224,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_XRFaT\GalaxySetup.exe" /lang=en_US /campaign="eyJjYW1wYWlnbiI6eyJvcmlnaW4iOiJodHRwOi8vZ2FsYXh5Mi1zaWdudXAuZ29nLnByb2QvcnUvP2VtYmVkZGFibGU9dHJ1ZSIsIm9yaWdpbl91c2VyX2FnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0Ni4wLjAuMCBZYUJyb3dzZXIvMjYuNC4wLjAgU2FmYXJpLzUzNy4zNiIsInVuaXF1ZV9pZCI6IjE3ODI5MjgzNjQtZHVta0p3TFY1WkRNcVd1WnlyVUdRUT09In0sImxvZ2luX3BhcmFtZXRlcnMiOiJvcmlnaW49aHR0cCUzQSUyRiUyRmdhbGF4eTItc2lnbnVwLmdvZy5wcm9kJTJGcnUlMkYlM0ZlbWJlZGRhYmxlJTNEdHJ1ZSZvcmlnaW5fdXNlcl9hZ2VudD1Nb3ppbGxhJTJGNS4wKyUyOFdpbmRvd3MrTlQrMTAuMCUzQitXaW42NCUzQit4NjQlMjkrQXBwbGVXZWJLaXQlMkY1MzcuMzYrJTI4S0hUTUwlMkMrbGlrZStHZWNrbyUyOStDaHJvbWUlMkYxNDYuMC4wLjArWWFCcm93c2VyJTJGMjYuNC4wLjArU2FmYXJpJTJGNTM3LjM2JnVuaXF1ZV9pZD0xNzgyOTI4MzY0LWR1bWtKd0xWNVpETXFXdVp5clVHUVElM0QlM0QifQ=="4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
InstallerWebinstaller.log
GalaxyInstaller.exe
icon.ico
payload.campaign
remoteconfig.json
_isdecmp.dll
GalaxySetup.tmp
memory/4352-43-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-42-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-13-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-12-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-11-0x0000000000270000-0x0000000000300000-memory.dmp
memory/4352-27-0x000000001E8B0000-0x000000001EDD8000-memory.dmp
memory/4352-31-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-32-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-33-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-34-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-35-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-36-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-37-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-38-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-40-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-41-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-44-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-39-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-26-0x000000001E1B0000-0x000000001E372000-memory.dmp
memory/4352-14-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-48-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-46-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-47-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-45-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-49-0x00007FFB792F0000-0x00007FFB79C94000-memory.dmp
memory/4352-10-0x00007FFB7947F000-0x00007FFB79480000-memory.dmp
memory/4616-63-0x0000000000400000-0x0000000000543000-memory.dmp
memory/4616-78-0x0000000000400000-0x0000000000543000-memory.dmp
memory/5036-0-0x00000000004B0000-0x0000000000671000-memory.dmp
memory/5424-95-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-81-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-87-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-83-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-79-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-89-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-91-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-93-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-85-0x0000000000400000-0x0000000000765000-memory.dmp
memory/5424-97-0x0000000000400000-0x0000000000765000-memory.dmp