Analysis
- max time kernel
150s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 17:57
General
- Target 2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe
- Size 39.8MB
- Sample260808-wjvs8sbl5v
- SHA256 77b05dd7a05e6169d849aa164e227673cd69b113f7263312fd41e513e501d9ff
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_4c4ad6850ea2c6563f6f9b44af095d43_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_redli.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\local\stubexe\0xDF608E3F6F1520B7\RevoUninPro.exe"C:\Program Files (x86)\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RevoUninPro.exe.__meta__
RevoUninPro.exe
dec_0x73410000.tls
dec_0x73460000.tls
dec_0x737f0000.tls
dec_0x73cd0000.tls
dec_0x745d0000.tls
dec_0x75670000.tls
dec_0x76ec0000.tls
xsandbox.bin
memory/3564-383-0x00000000733F0000-0x00000000733F2000-memory.dmp
memory/3564-61-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-42-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-45-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-49-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-50-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-51-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-53-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-33-0x0000000010000000-0x0000000010175000-memory.dmp
memory/3564-36-0x0000000000400000-0x000000000110C000-memory.dmp
memory/3564-35-0x0000000000400000-0x000000000110C000-memory.dmp
memory/3564-43-0x00000000737E0000-0x00000000737E2000-memory.dmp
memory/3564-37-0x0000000000400000-0x000000000110C000-memory.dmp
memory/3564-44-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-47-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-46-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-48-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-56-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-64-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-66-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-73-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-80-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-94-0x0000000076E50000-0x0000000076E9B000-memory.dmp
memory/3564-93-0x0000000076E50000-0x0000000076E9B000-memory.dmp
memory/3564-92-0x0000000076E50000-0x0000000076E9B000-memory.dmp
memory/3564-91-0x0000000076E50000-0x0000000076E9B000-memory.dmp
memory/3564-89-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-159-0x0000000073510000-0x0000000073512000-memory.dmp
memory/3564-52-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-286-0x0000000073450000-0x0000000073452000-memory.dmp
memory/3564-54-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-378-0x0000000073400000-0x0000000073402000-memory.dmp
memory/3564-449-0x00000000733E0000-0x00000000733E2000-memory.dmp
memory/3564-55-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-57-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-58-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-59-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-60-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-88-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-205-0x0000000073500000-0x0000000073502000-memory.dmp
memory/3564-62-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-87-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-86-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-85-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-84-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-83-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-82-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-81-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-79-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-78-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-77-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-76-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-75-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-74-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-72-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-70-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-69-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-68-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-67-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-65-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-71-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/3564-63-0x00000000737F0000-0x0000000073A17000-memory.dmp
memory/5104-11-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-0-0x00000000017E0000-0x000000000198E000-memory.dmp
memory/5104-9-0x0000000001620000-0x0000000001621000-memory.dmp
memory/5104-4-0x0000000077968000-0x0000000077969000-memory.dmp
memory/5104-2-0x0000000077968000-0x0000000077969000-memory.dmp
memory/5104-12-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-448-0x00000000017E0000-0x000000000198E000-memory.dmp
memory/5104-5-0x0000000077969000-0x000000007796A000-memory.dmp
memory/5104-13-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-28-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-10-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-14-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-15-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-17-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-16-0x0000000010000000-0x0000000010175000-memory.dmp
memory/5104-1-0x0000000077968000-0x0000000077969000-memory.dmp
memory/5104-488-0x0000000001620000-0x0000000001621000-memory.dmp