Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 09:29
General
- Target 2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe
- Size 12.4MB
- Sample260925-lgbbpsysay
- SHA256 0d334956125e8bfaa184ba34e97bb1570e1a36e8c9a19af77de6aaef9dd83f26
Malware Config
Signatures
- Detects executables calling ClearMyTracksByProcess 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop.exe'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\gunvui\'"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_ygidclw3.gi0.ps1
memory/1156-37-0x0000000007170000-0x0000000007213000-memory.dmp
memory/1156-38-0x0000000007900000-0x0000000007F7C000-memory.dmp
memory/1156-52-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1156-46-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1156-41-0x0000000007520000-0x00000000075B6000-memory.dmp
memory/1156-40-0x0000000007320000-0x000000000732A000-memory.dmp
memory/1156-29-0x0000000006590000-0x00000000065DC000-memory.dmp
memory/1156-39-0x00000000072B0000-0x00000000072CA000-memory.dmp
memory/1156-33-0x000000006E900000-0x000000006E94C000-memory.dmp
memory/1156-36-0x00000000064F0000-0x0000000006510000-memory.dmp
memory/1156-32-0x0000000006510000-0x0000000006546000-memory.dmp
memory/1156-23-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/1156-15-0x0000000002A50000-0x0000000002A86000-memory.dmp
memory/1156-16-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1156-28-0x0000000005F40000-0x0000000005F5E000-memory.dmp
memory/1156-18-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1156-19-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/1156-25-0x0000000005B20000-0x0000000005B86000-memory.dmp
memory/3408-20-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/3408-24-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/3408-48-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/3408-17-0x0000000004E50000-0x000000000549A000-memory.dmp
memory/3408-43-0x000000006E900000-0x000000006E94C000-memory.dmp
memory/4864-30-0x0000000074AE2000-0x0000000074AE3000-memory.dmp
memory/4864-7-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/4864-12-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/4864-9-0x0000000009AB0000-0x0000000009B32000-memory.dmp
memory/4864-0-0x0000000074AE2000-0x0000000074AE3000-memory.dmp
memory/4864-2-0x0000000005F40000-0x00000000064FA000-memory.dmp
memory/4864-42-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/4864-11-0x0000000009BD0000-0x0000000009BF2000-memory.dmp
memory/4864-8-0x0000000009A40000-0x0000000009AB0000-memory.dmp
memory/4864-31-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/4864-10-0x0000000009B50000-0x0000000009B7E000-memory.dmp
memory/4864-6-0x00000000059C0000-0x00000000059CA000-memory.dmp
memory/4864-13-0x000000000A7A0000-0x000000000AAFB000-memory.dmp
memory/4864-5-0x0000000005880000-0x000000000588E000-memory.dmp
memory/4864-3-0x00000000058C0000-0x0000000005952000-memory.dmp
memory/4864-1-0x00000000000F0000-0x0000000000D64000-memory.dmp
memory/4864-4-0x0000000074AD0000-0x000000007528C000-memory.dmp
memory/4864-51-0x0000000074AD0000-0x000000007528C000-memory.dmp