Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 07:05
General
- Target 2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 4.4MB
- Sample260804-hwgkgstdpg
- SHA256 ebf8dc0c80dc35fd8a07a327b415b7caa09731ba6dbdde157358fa24a3a99706
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 15 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\7xv84m7g13mni3iq240665375.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\1hxdl66nrv009c6240665375.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\uex4oka17w240665468.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\c0hb498wb240665468.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\yydggzkd7lo41rb240665750.tmp\" -Force"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\wsz7hqtbzd240682171.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\ixzki5byynia94r240682171.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\gcbt7iep9zb240682265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\urh234eizerpea240682265.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\pucxv8vj4240682546.tmp\" -Force"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
1hxdl66nrv009c6240665375.tmp
7xv84m7g13mni3iq240665375.tmp
__PSScriptPolicyTest_oy0j00i4.rd0.ps1
c0hb498wb240665468.tmp
cwlvnna9wbepczoxp4c3qpoo760.sess
gcbt7iep9zb240682265.tmp
ixzki5byynia94r240682171.tmp
pucxv8vj4240682546.tmp
uex4oka17w240665468.tmp
urh234eizerpea240682265.tmp
wsz7hqtbzd240682171.tmp
yydggzkd7lo41rb240665750.tmp
590aee7bdd69b59b.customDestinations-ms
590aee7bdd69b59b.customDestinations-ms
memory/2204-7-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-0-0x000000000066E000-0x000000000066F000-memory.dmp
memory/2204-87-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-8-0x00000000040D0000-0x0000000004177000-memory.dmp
memory/2204-44-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-86-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-32-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-14-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-6-0x0000000011000000-0x0000000011158000-memory.dmp
memory/2204-31-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-4-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-9-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-72-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-83-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-82-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-77-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-79-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-80-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/2204-81-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4884-22-0x000002C885CA0000-0x000002C885CC2000-memory.dmp
memory/4884-30-0x000002C8A0740000-0x000002C8A088E000-memory.dmp
memory/4884-12-0x000002C89E3C0000-0x000002C89E3D0000-memory.dmp
memory/4884-13-0x000002C89E3C0000-0x000002C89E3D0000-memory.dmp