Analysis
- user interaction
yes - max time kernel
72s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/10/2026, 17:51
General
- Target 2026-10-03_174b79d28f01b3d033457cb2f7fcce3b_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe
- Size 10.8MB
- Sample261004-we93cstepc
- SHA256 51287c7ae6b16c71480a1e93c7568f339c34adbdf1c1345a42398e85161151db
Malware Config
Signatures
- Family: PEASS, PEASS-ng, Peas
PEASS is an open-source tool for privilege escalation.
- Detects PEASS hacktool 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Program crash 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-03_174b79d28f01b3d033457cb2f7fcce3b_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-03_174b79d28f01b3d033457cb2f7fcce3b_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exe"systeminfo.exe"2⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 816442⤵
- Program crash
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e4 0x4581⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2336 -ip 23361⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
sqlite.interop.dll
memory/2336-24-0x000000000B570000-0x000000000BA9C000-memory.dmp
memory/2336-34-0x0000000006620000-0x0000000006630000-memory.dmp
memory/2336-7-0x0000000006620000-0x0000000006630000-memory.dmp
memory/2336-8-0x0000000006CA0000-0x0000000006CEA000-memory.dmp
memory/2336-9-0x0000000006D60000-0x0000000006DC6000-memory.dmp
memory/2336-10-0x0000000006D00000-0x0000000006D18000-memory.dmp
memory/2336-11-0x0000000006620000-0x0000000006630000-memory.dmp
memory/2336-12-0x0000000008690000-0x0000000008744000-memory.dmp
memory/2336-14-0x0000000006C50000-0x0000000006C5A000-memory.dmp
memory/2336-13-0x000000000A090000-0x000000000A634000-memory.dmp
memory/2336-15-0x0000000006ED0000-0x0000000006EF6000-memory.dmp
memory/2336-18-0x0000000008750000-0x000000000875A000-memory.dmp
memory/2336-17-0x0000000009BA0000-0x0000000009BB8000-memory.dmp
memory/2336-16-0x0000000006C60000-0x0000000006C68000-memory.dmp
memory/2336-19-0x0000000009BC0000-0x0000000009BC8000-memory.dmp
memory/2336-20-0x0000000009BF0000-0x0000000009BFA000-memory.dmp
memory/2336-21-0x0000000009C40000-0x0000000009C58000-memory.dmp
memory/2336-22-0x000000000AC00000-0x000000000AC92000-memory.dmp
memory/2336-23-0x000000000AE70000-0x000000000B032000-memory.dmp
memory/2336-0-0x0000000000F90000-0x0000000001A5C000-memory.dmp
memory/2336-6-0x0000000006830000-0x0000000006896000-memory.dmp
memory/2336-36-0x0000000040000000-0x00000000400C3000-memory.dmp
memory/2336-25-0x0000000006620000-0x0000000006630000-memory.dmp
memory/2336-40-0x000000000ADD0000-0x000000000ADEE000-memory.dmp
memory/2336-41-0x000000000BC80000-0x000000000BCA2000-memory.dmp
memory/2336-42-0x0000000040000000-0x000000004025B000-memory.dmp
memory/2336-50-0x0000000040000000-0x0000000040047000-memory.dmp
memory/2336-63-0x0000000040000000-0x000000004049D000-memory.dmp
memory/2336-74-0x0000000040000000-0x0000000040A99000-memory.dmp
memory/2336-86-0x0000000040000000-0x0000000040032000-memory.dmp
memory/2336-80-0x0000000040000000-0x000000004034B000-memory.dmp
memory/2336-92-0x0000000040000000-0x0000000040007000-memory.dmp
memory/2336-100-0x000000000BD80000-0x000000000BE43000-memory.dmp
memory/2336-104-0x000000000ADA0000-0x000000000ADA7000-memory.dmp
memory/2336-102-0x000000000C000000-0x000000000C34B000-memory.dmp
memory/2336-99-0x000000000BF10000-0x000000000C16B000-memory.dmp
memory/2336-98-0x000000000C050000-0x000000000C113000-memory.dmp
memory/2336-103-0x000000000BCB0000-0x000000000BD1A000-memory.dmp
memory/2336-105-0x00000000073F0000-0x0000000007440000-memory.dmp
memory/2336-111-0x000000000BCB0000-0x000000000BD1A000-memory.dmp
memory/2336-108-0x000000000BD80000-0x000000000BE43000-memory.dmp