Analysis
- max time kernel
124s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/08/2026, 00:23
General
- Target 2026-08-13_63c6acc701f9c856629b7501c451c462_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe
- Size 1007KB
- Sample260814-ap1e1saj71
- SHA256 ba7fefddf03c2e904577e6484d34e201c2330abc9255cdab182c2f49c314cb43
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_63c6acc701f9c856629b7501c451c462_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_63c6acc701f9c856629b7501c451c462_darkgate_elex_glassworm_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DvcAY\GalaxyInstaller.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DvcAY\GalaxyInstaller.exe" 1207658947 "Rayman 3: Hoodlum Havoc"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DvcAY\GalaxySetup.exe"C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DvcAY\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207658947 /silent /game_name="Rayman 3: Hoodlum Havoc"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TUUYPX0UZ3.tmp\GalaxySetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-TUUYPX0UZ3.tmp\GalaxySetup.tmp" /SL5="$70272,337782750,1791488,C:\Users\Admin\AppData\Local\Temp\GalaxyInstaller_DvcAY\GalaxySetup.exe" /lang=en_US /webinstaller /product_id=1207658947 /silent /game_name="Rayman 3: Hoodlum Havoc"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x86.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{F8CF1081-290D-46F5-8449-04A0088A8419}\.cr\vc_redist.x86.exe"C:\Windows\Temp\{F8CF1081-290D-46F5-8449-04A0088A8419}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x86.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5B8474F7-3189-431E-8858-13F998888D09}\.be\VC_redist.x86.exe"C:\Windows\Temp\{5B8474F7-3189-431E-8858-13F998888D09}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{DDC5F008-30B9-44E6-A17B-313BD6C7D84F} {435EF746-73D9-4609-905E-21439C102AE1} 29367⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x64.exe"C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x64.exe" /install /quiet /norestart5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{41CDB26E-4494-4E98-A7E7-80F607056FA3}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{41CDB26E-4494-4E98-A7E7-80F607056FA3}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-Y52GMZ62N0.tmp\vc_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart6⤵
- Executes dropped EXE
-
C:\Windows\Temp\{E6BF97E8-CE04-4A19-93C0-F0915206BB32}\.be\VC_redist.x64.exe"C:\Windows\Temp\{E6BF97E8-CE04-4A19-93C0-F0915206BB32}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{BDCA0BF0-1FE7-4CAA-BB2E-BE13C76C6228} {3BA74AFB-8BBF-4BB4-A18D-AE88E2EB292C} 42287⤵
-
-
-
-
C:\Program Files\GOG Galaxy\GalaxyClient.exe"C:\Program Files\GOG Galaxy\GalaxyClient.exe" /firstRun /installationSource=usedefault5⤵
-
-
C:\Program Files\GOG Galaxy\GalaxyClient.exe"C:\Program Files\GOG Galaxy\GalaxyClient.exe" /clientLanguage=en-US5⤵
-
-
-
-
-
C:\Program Files\GOG Galaxy\GalaxyClient.exe"C:\Program Files\GOG Galaxy\GalaxyClient.exe" /command=installationScreen /gameId=12076589472⤵
-
C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe"C:\Program Files\GOG Galaxy\QtWebEngineProcess.exe" --type=renderer --webengine-schemes=qrc:sV --first-renderer-process --disable-speech-api --disable-blink-features=EyeDropperAPI --lang=en --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=4196 /prefetch:13⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /burn.runonce1⤵
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260814012915.log" /install2⤵
-
C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{c157798c-9519-4e56-98d9-f696f78f4a61}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260814012915.log" /install3⤵
-
-
-
C:\Program Files\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"1⤵
-
C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe"1⤵
-
C:\Program Files\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"1⤵
-
C:\Program Files\GOG Galaxy\GalaxyClientService.exe"\\?\C:\Program Files\GOG Galaxy\GalaxyClientService.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
e5ac942.rbs
e5ac94e.rbs
GalaxyClient.exe
PocoData.dll
PocoDataSQLite.dll
PocoFoundation.dll
PocoJSON.dll
PocoNet.dll
PocoUtil.dll
Qt6Core.dll
Qt6Gui.dll
Qt6Network.dll
Qt6WebChannel.dll
Qt6WebEngineWidgets.dll
Qt6Widgets.dll
is-IWYMPSMWBL.tmp
is-R8V8S02QRV.tmp
sqlite.dll
is-6EWMGAVAR6.tmp
is-V5XPQCIOBF.tmp
xdelta3.dll
zlib1.dll
is-2BC6RIY7IR.tmp
is-IZERV076E1.tmp
config.json
config.json
config.json
InstallerWebinstaller.log
is-TOBRSSYK39.tmp
f_000006
CURRENT
config.json
GalaxyInstaller.exe
icon.ico
remoteconfig.json
dd_vcredist_amd64_20260814012915.log
dd_vcredist_amd64_20260814012915_000_vcRuntimeMinimum_x64.log
GalaxySetup.tmp
_isdecmp.dll
vc_redist.x64.exe
vc_redist.x86.exe
MSVCP140.dll
MSVCP140_ATOMIC_WAIT.dll
license.rtf
thm.wxl
thm.xml
vc_redist.x64.exe
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
vc_redist.x86.exe
memory/2672-2548-0x0000000000520000-0x0000000000599000-memory.dmp
memory/2676-2858-0x00007FFFAD7A0000-0x00007FFFAD7A1000-memory.dmp
memory/2676-2860-0x00007FFF89F80000-0x00007FFF8A504000-memory.dmp
memory/2676-2859-0x00007FFFAEB80000-0x00007FFFAEB81000-memory.dmp
memory/3312-2832-0x00007FFF8BC60000-0x00007FFF8C2A7000-memory.dmp
memory/3312-2833-0x00007FFF89F80000-0x00007FFF8A504000-memory.dmp
memory/3508-32-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-17-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-36-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-35-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-34-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-33-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-41-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-31-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-14-0x00007FFF8C95F000-0x00007FFF8C960000-memory.dmp
memory/3508-42-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-30-0x000000001E9D0000-0x000000001EEF8000-memory.dmp
memory/3508-15-0x00000000003E0000-0x0000000000400000-memory.dmp
memory/3508-2831-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-29-0x000000001E2D0000-0x000000001E492000-memory.dmp
memory/3508-18-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-16-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/3508-37-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp
memory/4288-473-0x0000000000AA0000-0x0000000000C6B000-memory.dmp
memory/4288-2825-0x0000000000AA0000-0x0000000000C6B000-memory.dmp
memory/4288-56-0x0000000000AA0000-0x0000000000C6B000-memory.dmp
memory/4380-2814-0x00007FFF868D0000-0x00007FFF86E54000-memory.dmp
memory/4380-2813-0x00007FFF86280000-0x00007FFF868C7000-memory.dmp
memory/4380-2815-0x00007FFF6CB50000-0x00007FFF6DB50000-memory.dmp
memory/4540-2549-0x0000000000520000-0x0000000000599000-memory.dmp
memory/4556-0-0x0000000000DA0000-0x0000000000E9C000-memory.dmp
memory/5008-2039-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5008-741-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5008-2003-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5008-2824-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5008-2117-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5008-2808-0x0000000000590000-0x0000000000C9D000-memory.dmp
memory/5448-2312-0x00007FFF80EE0000-0x00007FFF81464000-memory.dmp
memory/5448-2311-0x00007FFF865C0000-0x00007FFF86C07000-memory.dmp