Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 16:37
General
- Target 2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe
- Size 6.3MB
- Sample260825-t415msaa22
- SHA256 2a996426bac6cb1b1cc1fd028a9f706e4a24204667b1ff1306e680a633437787
Malware Config
Signatures
- Detects executables packed with Enigma 2 IoCs
- Detects packed executables observed in Molerats 2 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_2b5fa9f6d262bbeb283ac5f30de36e15_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb73B0.tmp
settings.sxx
memory/4616-0-0x0000000000400000-0x00000000009F1000-memory.dmp
memory/4616-1-0x00000000776B8000-0x00000000776B9000-memory.dmp
memory/4616-2-0x00000000776B9000-0x00000000776BA000-memory.dmp
memory/4616-6-0x0000000010000000-0x0000000010063000-memory.dmp
memory/4616-10-0x000000000080D000-0x000000000080E000-memory.dmp
memory/4616-9-0x0000000010000000-0x0000000010063000-memory.dmp
memory/4616-76-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-81-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-82-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-80-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-72-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-78-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-79-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-74-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-75-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-73-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-77-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-134-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-129-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-127-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-123-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-122-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-121-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-1230-0x0000000000400000-0x00000000009F1000-memory.dmp
memory/4616-119-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-117-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-115-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-113-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-112-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-111-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-109-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-108-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-107-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-106-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-105-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-103-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-102-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-101-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-100-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-97-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-99-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-1235-0x0000000010000000-0x0000000010063000-memory.dmp
memory/4616-96-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-95-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-94-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-93-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-92-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-91-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-87-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-86-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-84-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-85-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-136-0x0000000003B80000-0x0000000003D80000-memory.dmp
memory/4616-135-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-133-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-132-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-131-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-130-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-128-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-126-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-125-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-124-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-120-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-118-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-116-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-114-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-110-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-104-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-90-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-89-0x0000000009BD0000-0x0000000009DD0000-memory.dmp
memory/4616-88-0x0000000009BD0000-0x0000000009DD0000-memory.dmp