b5cc7ab25d301d66d2bb347fcbbb4e7dd86ffd7b6c71c576580303e76c442d7c

General

Target
2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe
Size 29.9MB
Sample260804-2syjdafl6v
SHA256 b5cc7ab25d301d66d2bb347fcbbb4e7dd86ffd7b6c71c576580303e76c442d7c
MD5 6ad3e8b71854b234abb6cbf9e220fdc9
SHA1 ce4805d5c10090b16630a653a452305dd0d97f48
SHA512 9f4664ca68826414d3986a28807ea05dd009d4d66dba630e73e8e41decf9c8798feee3b4ba3a189461ff82d947a9ab59a1eaecbfc950e08bfe6dea21b4afd969
SSDEEP 786432:DJx08YcB4hE61mr+bVt/B7mmJSRsNdLyvMOKEa7:DxYcBgE9vMOKEa7
TLSH
T18267BF01F78350B9C80B0675206FF36EAB396E25433987E7A7E42E25BC717C11E39A56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1208	icacls.exe
5744	icacls.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_4C7C55602022475C	은성원격지원.exe

Executes dropped EXE 3 IoCs

pid	Process
2088	은성원격지원.exe
3108	은성원격지원.exe
720	은성원격지원.exe

Loads dropped DLL 2 IoCs

pid	Process
2088	은성원격지원.exe
2088	은성원격지원.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
716	cmd.exe
4948	cmd.exe
1776	cmd.exe
3684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	은성원격지원.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	은성원격지원.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	은성원격지원.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
5760	taskkill.exe
3080	taskkill.exe
3264	taskkill.exe
2512	taskkill.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2088	은성원격지원.exe
3108	은성원격지원.exe
3108	은성원격지원.exe
720	은성원격지원.exe
2088	은성원격지원.exe
2088	은성원격지원.exe
2088	은성원격지원.exe
2088	은성원격지원.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3080	taskkill.exe
Token: SeDebugPrivilege	3264	taskkill.exe
Token: SeDebugPrivilege	2512	taskkill.exe
Token: SeDebugPrivilege	3108	은성원격지원.exe
Token: SeDebugPrivilege	5760	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2088	은성원격지원.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 716	1172	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe	89
PID 716 wrote to memory of 3080	716	cmd.exe	91
PID 1172 wrote to memory of 4948	1172	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe	93
PID 4948 wrote to memory of 3264	4948	cmd.exe	95
PID 1172 wrote to memory of 1776	1172	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe	96
PID 1776 wrote to memory of 2512	1776	cmd.exe	98
PID 1172 wrote to memory of 3560	1172	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe	99
PID 1172 wrote to memory of 2088	1172	2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe	101
PID 2088 wrote to memory of 5744	2088	은성원격지원.exe	103
PID 2088 wrote to memory of 1208	2088	은성원격지원.exe	104
PID 2088 wrote to memory of 3108	2088	은성원격지원.exe	107
PID 2088 wrote to memory of 3684	2088	은성원격지원.exe	110
PID 3684 wrote to memory of 5760	3684	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6ad3e8b71854b234abb6cbf9e220fdc9_akira_amadey_darkgate_elex_glassworm_helldown_luca-steal.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /F /T /IM "은성원격지원.exe" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM "은성원격지원.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /F /T /IM "wmremote.exe" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM "wmremote.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /F /T /IM "rustdesk.exe" >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /T /IM "rustdesk.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c del /f /q "C:\Walkmedia\Driver\WMremote\app\*" >nul 2>nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3560
- C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe
  "C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\WMremote /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5744
- - C:\Windows\SysWOW64\icacls.exe
    "icacls" C:\ProgramData\WMremote\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1208
- - C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe
    "C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe" --portable-service
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
  - - C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe
      "C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe" --run-as-system
      4⤵
      Drops file in Windows directory
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:720
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM RuntimeBroker_rustdesk.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\WMremote\shared_memory_portable_service
Size 23B
SHA256 6d9e96991fae9cef743f279ec8715798b26310e2401777c45c8b42860c02970d
MD5 8b73ba0e542439d0730631acf90ec179
SHA1 1acbbfe90d458baa418b76c80e124565fce6e0b3
SHA512 7405a39adcaadec82e4d42d7d3d88bac6c588f1ffe2adeedcbcd97eda53287c7258a49123ab7fb966021194f3557614fa541363a5ec403294407b82aa7028f33
MD5 SHA1 SHA512

Submit Download

sciter.dll

Path C:\Walkmedia\Driver\WMremote\app\sciter.dll
Size 5.8MB
SHA256 742c073827de804fe89e588bfc9e2c266314bdc10f452d2c4efd1115de12eb71
MD5 de5f3cc6d0e0fd0697585ce7c67faee7
SHA1 14cd8ae0dbe9525b1df54f8e35decdb890059305
SHA512 5baecfa34855edd278302be049ece3702fe1b91d29999a31abedeb41805135299e9112080ee40b143174341c3941a91aabd929f405c797afc6871a12e4053939
SSDEEP 98304:4KwCpE+mBoEBDeasdzH/cs8cfQW6OUiCpIWLQCIFBRQlt3RHffOYVvsIrqNkJW6p:4KL/ERqH/TQW6OKuWL6FERAIrqNp/8L
TLSH
T1F156AF23BB95803DC42F02B06E6EF37D81FABE7005B0412B2BB87E5D6EB09E15655563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

은성원격지원.exe

Path C:\Walkmedia\Driver\WMremote\app\은성원격지원.exe
Size 23.9MB
SHA256 5e963f32ec0d47ac1c1bd3a0a2e3b25ad7aa1b07f4c01c9536d39b74da2c1f0d
MD5 2f408ecf84495931b2c2893357812b6e
SHA1 e3f42acdaf1bfa6563ac6f1d19fe2bdcb950b137
SHA512 6599cc478e5bac170bc5cdfd9fc91264cebf413f34e47b19b4283fd4b8973a122fdd6df62aa318dc0c8a41d47062b94fc0cf30747120318a57d6fd66e97822b7
SSDEEP 393216:gGekka08YcB4YMwnB/JlO1mr+bVt/B7mmJsbRsNSa60NjwBobZrEy7E4st+8m2xo:ZJx08YcB4hE61mr+bVt/B7mmJSRsNdL
TLSH
T1BF47BF45F7C351B5C80A0A35206FB32EAB355925832ACBE3E3E45E25BC717C21E39E56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

은성원격지원_rCURRENT.log

Path C:\Walkmedia\Driver\WMremote\log\은성원격지원_rCURRENT.log
Size 1KB
SHA256 4c515c1d64f0393424619657f4ef8600324a15c0954609fb270eb03c639e4901
MD5 ff77d12b9dc64c155d06c9171723fcef
SHA1 9eb8a2e9b4cbbfc135d49cc75ad3cc72ec0cf9bf
SHA512 d4a8b885f57ec842d2bab4ac79a6d66a4ccade1d0802c9b068f15842862b179599ca0c1313acfea51c80fd778be86f57eb4e030403ebdabcb549a3d6ff73a2f6
TLSH
T1D731921101FD2C5B2E076C9FD18B5708160BB04BD5145938EBF173AE18BA4CB78BEE89
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads