Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 04:25
General
- Target 2026-07-22_0232d8fce6044f6e13b5acd0c964565e_akira_amadey_darkgate_elex_glassworm.exe
- Size 3.5MB
- Sample260722-e2d5rsvyhw
- SHA256 a0e0ba8ca27b68979819e03cb64097b9f608001cffc36d64b828e0d65078ca07
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_0232d8fce6044f6e13b5acd0c964565e_akira_amadey_darkgate_elex_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_0232d8fce6044f6e13b5acd0c964565e_akira_amadey_darkgate_elex_glassworm.exe"1⤵
-
C:\ProgramData\AppRepository\0a2c0f09\erRela.exeC:\ProgramData\AppRepository\0a2c0f09\erRela.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4124-9-0x0000000073602000-0x0000000073603000-memory.dmp
memory/4124-10-0x0000000006A60000-0x0000000006ACE000-memory.dmp
memory/4124-11-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-12-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-13-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-14-0x0000000006EC0000-0x0000000006EDA000-memory.dmp
memory/4124-15-0x0000000006EE0000-0x0000000006F0C000-memory.dmp
memory/4124-17-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-27-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-141-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-139-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-137-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-135-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-133-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-131-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-129-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-127-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-125-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-123-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-121-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-119-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-117-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-115-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-113-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-111-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-109-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-107-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-105-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-103-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-101-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-99-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-97-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-95-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-93-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-91-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-89-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-87-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-85-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-83-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-81-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-79-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-77-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-75-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-73-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-71-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-69-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-67-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-65-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-63-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-61-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-59-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-57-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-55-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-53-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-51-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-49-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-47-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-45-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-43-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-41-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-39-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-37-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-35-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-33-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-31-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-29-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-25-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-23-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-21-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-16-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-19-0x0000000006EE0000-0x0000000006F06000-memory.dmp
memory/4124-642-0x00000000073E0000-0x0000000007446000-memory.dmp
memory/4124-643-0x0000000073602000-0x0000000073603000-memory.dmp
memory/4124-644-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-645-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-646-0x00000000735F0000-0x0000000073DAC000-memory.dmp
memory/4124-647-0x0000000007B10000-0x0000000007BA2000-memory.dmp
memory/4124-648-0x0000000008170000-0x000000000872A000-memory.dmp
memory/4124-649-0x0000000007F80000-0x0000000008004000-memory.dmp
memory/4124-2904-0x0000000007530000-0x000000000753A000-memory.dmp