Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 21:50
General
- Target 2026-08-25_708eeddfa399bde37ee62bc1c6a49738_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe
- Size 12.5MB
- Sample260826-1pyvasbn81
- SHA256 4271f50539a763a4117e194a7028d4d4abbabbbcf541d6d41b72efbb08688c07
Malware Config
Signatures
- Detects executables calling ClearMyTracksByProcess 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_708eeddfa399bde37ee62bc1c6a49738_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_708eeddfa399bde37ee62bc1c6a49738_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-25_708eeddfa399bde37ee62bc1c6a49738_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\gun9x\'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_z1plo2um.emu.ps1
memory/2500-38-0x0000000007480000-0x000000000748A000-memory.dmp
memory/2500-30-0x0000000007080000-0x00000000070B6000-memory.dmp
memory/2500-20-0x0000000074950000-0x000000007510C000-memory.dmp
memory/2500-36-0x0000000007A50000-0x00000000080CC000-memory.dmp
memory/2500-37-0x0000000007410000-0x000000000742A000-memory.dmp
memory/2500-35-0x00000000072C0000-0x0000000007363000-memory.dmp
memory/2500-46-0x0000000074950000-0x000000007510C000-memory.dmp
memory/2500-34-0x0000000006660000-0x0000000006680000-memory.dmp
memory/2500-31-0x000000006E780000-0x000000006E7CC000-memory.dmp
memory/2500-39-0x0000000007680000-0x0000000007716000-memory.dmp
memory/2500-29-0x0000000006170000-0x00000000061BC000-memory.dmp
memory/2500-28-0x0000000005F70000-0x0000000005F8E000-memory.dmp
memory/2500-23-0x0000000005B70000-0x0000000005BD6000-memory.dmp
memory/2500-22-0x00000000059D0000-0x0000000005A36000-memory.dmp
memory/2500-18-0x0000000074950000-0x000000007510C000-memory.dmp
memory/2500-17-0x0000000005260000-0x00000000058AA000-memory.dmp
memory/2500-19-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4460-21-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4460-40-0x000000006E780000-0x000000006E7CC000-memory.dmp
memory/4460-16-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4460-15-0x0000000002B30000-0x0000000002B66000-memory.dmp
memory/4460-49-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4712-6-0x0000000006500000-0x000000000650A000-memory.dmp
memory/4712-3-0x0000000006540000-0x00000000065D2000-memory.dmp
memory/4712-10-0x000000000A740000-0x000000000A76E000-memory.dmp
memory/4712-9-0x000000000A6A0000-0x000000000A722000-memory.dmp
memory/4712-8-0x000000000A630000-0x000000000A6A0000-memory.dmp
memory/4712-7-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4712-0-0x0000000074962000-0x0000000074963000-memory.dmp
memory/4712-5-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4712-4-0x0000000003F10000-0x0000000003F1E000-memory.dmp
memory/4712-11-0x000000000A7C0000-0x000000000A7E2000-memory.dmp
memory/4712-12-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4712-41-0x0000000074962000-0x0000000074963000-memory.dmp
memory/4712-44-0x0000000074950000-0x000000007510C000-memory.dmp
memory/4712-2-0x0000000006C20000-0x00000000071DA000-memory.dmp
memory/4712-1-0x0000000000E20000-0x0000000001AA0000-memory.dmp
memory/4712-13-0x000000000B390000-0x000000000B6EB000-memory.dmp
memory/4712-50-0x0000000074950000-0x000000007510C000-memory.dmp