Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/08/2026, 16:37
General
- Target 2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 6.3MB
- Sample260825-t415msaa22
- SHA256 2a996426bac6cb1b1cc1fd028a9f706e4a24204667b1ff1306e680a633437787
Malware Config
Signatures
- Detects executables packed with Enigma 2 IoCs
- Detects packed executables observed in Molerats 2 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2c8 0x4041⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb1AF6.tmp
settings.sxx
memory/2696-2-0x00000000778E3000-0x00000000778E4000-memory.dmp
memory/2696-1-0x00000000778E2000-0x00000000778E3000-memory.dmp
memory/2696-0-0x0000000000400000-0x00000000009F1000-memory.dmp
memory/2696-9-0x0000000010000000-0x0000000010063000-memory.dmp
memory/2696-6-0x0000000010000000-0x0000000010063000-memory.dmp
memory/2696-10-0x000000000080D000-0x000000000080E000-memory.dmp
memory/2696-74-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-79-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-82-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-81-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-80-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-78-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-77-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-76-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-75-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-73-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-72-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-84-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-131-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-137-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-143-0x0000000003890000-0x0000000003A90000-memory.dmp
memory/2696-142-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-141-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-140-0x0000000003890000-0x0000000003A90000-memory.dmp
memory/2696-139-0x0000000003890000-0x0000000003A90000-memory.dmp
memory/2696-138-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-136-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-135-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-134-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-133-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-132-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-130-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-129-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-128-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-127-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-124-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-122-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-121-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-119-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-118-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-117-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-114-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-111-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-106-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-104-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-103-0x0000000003A90000-0x0000000003C90000-memory.dmp
memory/2696-102-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-101-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-100-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-99-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-98-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-97-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-144-0x0000000003890000-0x0000000003A90000-memory.dmp
memory/2696-96-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-95-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-94-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-93-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-92-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-91-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-85-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-126-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-125-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-123-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-120-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-112-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-108-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-107-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-105-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-86-0x0000000008AB0000-0x0000000008CB0000-memory.dmp
memory/2696-1179-0x0000000000400000-0x00000000009F1000-memory.dmp
memory/2696-1259-0x0000000010000000-0x0000000010063000-memory.dmp