Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 02:20
General
- Target 2026-08-08_ffa89657db778e9a8e3f4544fc738270_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe
- Size 928KB
- Sample260808-csj9ba1tex
- SHA256 e4103169d3618dd825cb2fe450c4604606b942b226e8f79c86d6ac35be629f03
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 25 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 7 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 41 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_ffa89657db778e9a8e3f4544fc738270_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_ffa89657db778e9a8e3f4544fc738270_amadey_darkgate_elex_glassworm_hawkeye_maze_smoke-loader.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
dotnet.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/620-1-0x0000000003130000-0x0000000003199000-memory.dmp
memory/620-0-0x0000000000E10000-0x0000000000FB6000-memory.dmp
memory/620-26-0x0000000000E10000-0x0000000000FB6000-memory.dmp
memory/620-7-0x0000000003130000-0x0000000003199000-memory.dmp
memory/632-270-0x0000026B3CA00000-0x0000026B3CA66000-memory.dmp
memory/632-354-0x00007FF7C49A0000-0x00007FF7C4A89000-memory.dmp
memory/632-269-0x0000026B3CA00000-0x0000026B3CA66000-memory.dmp
memory/632-268-0x00007FF7C49A0000-0x00007FF7C4A89000-memory.dmp
memory/888-471-0x00007FF6E8D80000-0x00007FF6E903D000-memory.dmp
memory/888-351-0x00007FF6E8D80000-0x00007FF6E903D000-memory.dmp
memory/912-246-0x000002913F6F0000-0x000002913F756000-memory.dmp
memory/912-245-0x000002913F6F0000-0x000002913F756000-memory.dmp
memory/912-253-0x00007FF73D170000-0x00007FF73D3F7000-memory.dmp
memory/912-251-0x000002913F6F0000-0x000002913F756000-memory.dmp
memory/912-244-0x00007FF73D170000-0x00007FF73D3F7000-memory.dmp
memory/1116-345-0x000001F670A70000-0x000001F670AD6000-memory.dmp
memory/1116-341-0x00007FF6EDBC0000-0x00007FF6EDFE8000-memory.dmp
memory/1116-339-0x000001F670A70000-0x000001F670AD6000-memory.dmp
memory/1116-347-0x00007FF6EDBC0000-0x00007FF6EDFE8000-memory.dmp
memory/1116-340-0x000001F670A70000-0x000001F670AD6000-memory.dmp
memory/1132-375-0x000002B7663A0000-0x000002B766406000-memory.dmp
memory/1132-374-0x000002B7663A0000-0x000002B766406000-memory.dmp
memory/1132-373-0x00007FF61BD60000-0x00007FF61BE9A000-memory.dmp
memory/1132-476-0x00007FF61BD60000-0x00007FF61BE9A000-memory.dmp
memory/1360-470-0x00007FF7C1680000-0x00007FF7C180E000-memory.dmp
memory/1360-333-0x000001CAB0C90000-0x000001CAB0CF6000-memory.dmp
memory/1360-331-0x00007FF7C1680000-0x00007FF7C180E000-memory.dmp
memory/1360-332-0x000001CAB0C90000-0x000001CAB0CF6000-memory.dmp
memory/1904-298-0x00007FF672D80000-0x00007FF6731EC000-memory.dmp
memory/1904-296-0x0000027FDB760000-0x0000027FDB7C6000-memory.dmp
memory/1904-382-0x00007FF672D80000-0x00007FF6731EC000-memory.dmp
memory/1904-450-0x0000027FDB760000-0x0000027FDB7C6000-memory.dmp
memory/1904-297-0x0000027FDB760000-0x0000027FDB7C6000-memory.dmp
memory/1904-452-0x00007FF672D80000-0x00007FF6731EC000-memory.dmp
memory/2156-363-0x0000000000400000-0x0000000000548000-memory.dmp
memory/2156-282-0x0000000000400000-0x0000000000548000-memory.dmp
memory/2156-276-0x0000000000840000-0x00000000008A9000-memory.dmp
memory/2156-281-0x0000000000840000-0x00000000008A9000-memory.dmp
memory/2404-473-0x000001F6F4240000-0x000001F6F4248000-memory.dmp
memory/2404-385-0x00007FF6D7210000-0x00007FF6D7563000-memory.dmp
memory/2404-384-0x000001F6E9A40000-0x000001F6E9AA6000-memory.dmp
memory/2404-383-0x000001F6E9A40000-0x000001F6E9AA6000-memory.dmp
memory/2404-406-0x000001F6EABB0000-0x000001F6EABC0000-memory.dmp
memory/2404-390-0x000001F6EA980000-0x000001F6EA990000-memory.dmp
memory/2404-422-0x000001F6F2F70000-0x000001F6F2F78000-memory.dmp
memory/2404-477-0x00007FF6D7210000-0x00007FF6D7563000-memory.dmp
memory/2488-32-0x00000124F8220000-0x00000124F8286000-memory.dmp
memory/2488-30-0x00000124F8220000-0x00000124F8286000-memory.dmp
memory/2488-29-0x00000124F8050000-0x00000124F814B000-memory.dmp
memory/2952-289-0x000001FACC2B0000-0x000001FACC316000-memory.dmp
memory/2952-290-0x000001FACC2B0000-0x000001FACC316000-memory.dmp
memory/2952-372-0x00007FF71C0C0000-0x00007FF71C167000-memory.dmp
memory/2952-288-0x00007FF71C0C0000-0x00007FF71C167000-memory.dmp
memory/2988-306-0x0000019F9B6F0000-0x0000019F9B756000-memory.dmp
memory/2988-428-0x00007FF684870000-0x00007FF68491A000-memory.dmp
memory/2988-305-0x00007FF684870000-0x00007FF68491A000-memory.dmp
memory/2988-307-0x0000019F9B6F0000-0x0000019F9B756000-memory.dmp
memory/3516-61-0x00000137A73C0000-0x00000137A7426000-memory.dmp
memory/3516-60-0x00000137A73C0000-0x00000137A7426000-memory.dmp
memory/3516-59-0x00000137A71F0000-0x00000137A72EB000-memory.dmp
memory/3532-39-0x00000181B2FD0000-0x00000181B3036000-memory.dmp
memory/3532-38-0x00000181B2E00000-0x00000181B2EFB000-memory.dmp
memory/3532-41-0x00000181B2FD0000-0x00000181B3036000-memory.dmp
memory/3676-355-0x00007FF7DE270000-0x00007FF7DE74C000-memory.dmp
memory/3676-472-0x00007FF7DE270000-0x00007FF7DE74C000-memory.dmp
memory/3676-357-0x000002777C720000-0x000002777C786000-memory.dmp
memory/3676-356-0x000002777C720000-0x000002777C786000-memory.dmp
memory/3924-315-0x000001ACBCB70000-0x000001ACBCBD6000-memory.dmp
memory/3924-438-0x00007FF76C4D0000-0x00007FF76C7F3000-memory.dmp
memory/3924-314-0x000001ACBCB70000-0x000001ACBCBD6000-memory.dmp
memory/3924-313-0x00007FF76C4D0000-0x00007FF76C7F3000-memory.dmp
memory/4028-47-0x00007FF70E140000-0x00007FF70E2A7000-memory.dmp
memory/4028-54-0x000001AD8DA60000-0x000001AD8DAC6000-memory.dmp
memory/4028-56-0x00007FF70E140000-0x00007FF70E2A7000-memory.dmp
memory/4028-48-0x000001AD8DA60000-0x000001AD8DAC6000-memory.dmp
memory/4028-49-0x000001AD8DA60000-0x000001AD8DAC6000-memory.dmp
memory/4200-238-0x000002A16D750000-0x000002A16D7B6000-memory.dmp
memory/4200-237-0x000002A16D750000-0x000002A16D7B6000-memory.dmp
memory/4200-236-0x00007FF6BD0E0000-0x00007FF6BD1C3000-memory.dmp
memory/4200-330-0x00007FF6BD0E0000-0x00007FF6BD1C3000-memory.dmp
memory/4340-324-0x00000203937E0000-0x0000020393846000-memory.dmp
memory/4340-323-0x00000203937E0000-0x0000020393846000-memory.dmp
memory/4340-322-0x00007FF613EA0000-0x00007FF61408E000-memory.dmp
memory/4340-443-0x00007FF613EA0000-0x00007FF61408E000-memory.dmp
memory/4600-257-0x0000021C44D70000-0x0000021C44DD6000-memory.dmp
memory/4600-350-0x00007FF73A210000-0x00007FF73A323000-memory.dmp
memory/4600-258-0x0000021C44D70000-0x0000021C44DD6000-memory.dmp
memory/4600-256-0x00007FF73A210000-0x00007FF73A323000-memory.dmp
memory/4964-15-0x00007FF6B4100000-0x00007FF6B41E6000-memory.dmp
memory/4964-18-0x0000028AAD4F0000-0x0000028AAD556000-memory.dmp
memory/4964-65-0x00007FF6B4100000-0x00007FF6B41E6000-memory.dmp
memory/4964-16-0x0000028AAD4F0000-0x0000028AAD556000-memory.dmp
memory/5084-365-0x00000218367E0000-0x0000021836846000-memory.dmp
memory/5084-475-0x00007FF688100000-0x00007FF68862A000-memory.dmp
memory/5084-364-0x00000218367E0000-0x0000021836846000-memory.dmp
memory/5084-369-0x00007FF688100000-0x00007FF68862A000-memory.dmp