Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 04:32
General
- Target 2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.exe
- Size 75.1MB
- Sample260816-e53brsdj5v
- SHA256 afd132c15d63c3dfc56531c8424bdc57dc94f55c563ee9b2da155dd1f73577fc
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DF2H5.tmp\2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.tmp"C:\Users\Admin\AppData\Local\Temp\is-DF2H5.tmp\2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.tmp" /SL5="$4019A,78007734,192512,C:\Users\Admin\AppData\Local\Temp\2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\InfoForSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\InfoForSetup.exe" /SendInfo "Window" "Langsel" "Activity" "Click_Confirm" "Attribute" "{\"Language\":\"en\"}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\AliyunWrapExe.ExeC:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\AliyunWrapExe.Exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\InfoForSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-2H2GI.tmp\InfoForSetup.exe" /SendInfo "Window" "Setup" "Activity" "Click_Next"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AliyunConfig.ini
AliyunConfig.ini
AliyunWrap.DLL
AliyunWrapExe.Exe
DataFile.ini
DataFile.ini
DataFile.ini
DataFile.ini
InfoForSetup.exe
tempInfo.web
2026-08-16_585bd9e7792f64543430ae99dc2043ac_amadey_darkgate_elex_gcleaner_glassworm_hellokitty_hijac.tmp
memory/248-89-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-95-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-45-0x0000000000850000-0x0000000000851000-memory.dmp
memory/248-111-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-109-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-76-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-6-0x0000000000850000-0x0000000000851000-memory.dmp
memory/248-91-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-93-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-44-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-97-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-99-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-101-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-103-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-105-0x0000000000400000-0x000000000053E000-memory.dmp
memory/248-107-0x0000000000400000-0x000000000053E000-memory.dmp
memory/1112-43-0x0000000000400000-0x0000000000439000-memory.dmp
memory/1112-0-0x0000000000400000-0x0000000000439000-memory.dmp