Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 07:05
General
- Target 2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 4.4MB
- Sample260804-hwgkgstdpg
- SHA256 ebf8dc0c80dc35fd8a07a327b415b7caa09731ba6dbdde157358fa24a3a99706
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 17 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_61515d10d01cfebfbc5d60d3811e4c89_amadey_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\ioyh6jq9c8d0v240751406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\yortlow0xu5b240751406.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\xpr1j695k240751500.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\kov0g8d6q2240751500.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\rqxo9re9ml0a0l9s240751781.tmp\" -Force"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\e4vzftr649zv6m240767578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\f59emzjht240767578.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\mmhkhts9slwva240767656.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\csjn9tum240767656.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\utfs7niqg3411240767875.tmp\" -Force"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
t1lhtoo9k1mfk1245d7adfuo2ppn76460.sess
590aee7bdd69b59b.customDestinations-ms
7G6CF08FP9GN875ZNKDB.temp
memory/4200-49-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-52-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-10-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-58-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-57-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-56-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-55-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-54-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-53-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-9-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-50-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-0-0x000000000066E000-0x000000000066F000-memory.dmp
memory/4200-25-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-26-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-29-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-8-0x0000000004540000-0x00000000045E7000-memory.dmp
memory/4200-7-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-6-0x0000000011000000-0x0000000011158000-memory.dmp
memory/4200-1-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/4200-43-0x0000000000400000-0x0000000000A61000-memory.dmp
memory/5440-24-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-23-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-21-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-20-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-19-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-18-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-17-0x00007FFCADF60000-0x00007FFCAE904000-memory.dmp
memory/5440-16-0x000001CFB08C0000-0x000001CFB08E2000-memory.dmp
memory/5440-13-0x00007FFCAE0EF000-0x00007FFCAE0F0000-memory.dmp