Overview

overview

7

Static

static

3

2026-10-09...at.exe

windows10-2004-x64

7

2026-10-09...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/10/2026, 23:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 36.1MB
  • Sample261009-22be7sxt8n
  • SHA256 428b1bb169ddd86dc06953631cda9e6435d990521e95cdf567a5871116cf1d3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Writes a Windows system DLL name to a user directory
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_installer_customer.exe
      "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_installer_customer.exe " "/LoaderPath C:\Users\Admin\AppData\Local\Temp\2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe" "/LogPath C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1737\20261010_000423\" "/RestartReason Start"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_service.exe
        "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_service.exe" "Start=start_session&LoaderPath=C:\Users\Admin\AppData\Local\Temp\2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1737\20261010_000423\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_comm_customer.exe
          "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_comm_customer.exe" "LoaderPath=C:\Users\Admin\AppData\Local\Temp\2026-10-09_ff7046df14fbe8c125fca3d26379c4f0_amadey_coinminer_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe&LogName=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1737\20261010_000423\GoToAssist Remote Support Customer.LOG&LogPath=C:\Users\Admin\AppData\Local\Temp\LogMeInLogs\GoToAssist Remote Support Customer\1737\20261010_000423\&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RestartReason=Start&Start=start_session&StartID={7CEE6B1D-3BF0-49C8-BCAE-BD12ED34F288}&UniqueId=1096"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_system_customer.exe
            "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_system_customer.exe" "StartID={F32600AD-3BA7-4DDB-B313-1DC036E78344}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=On&StatDb=On&Index=0"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:252
          • C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_user_customer.exe
            "C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_user_customer.exe" "StartID={73014A1A-4FD9-41B4-8541-3F2EA0FC57B3}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&Debug=Off&Stat=Off&StatDb=Off&Index=0"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        g2ax_combined_customer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_combined_customer.dll
        • Size 14.9MB
        • SHA256 5e68303c70cf497a065cfdabcf33c192735b5e53cbbbc8a77fd653688335e8e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        g2ax_customer_resource_win32_x86_en_US.dll
        • Path C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_customer_resource_win32_x86_en_US.dll
        • Size 2.7MB
        • SHA256 239401bb9750ab87c183ab13f94ae4bde239e9d20eed499cc578dfa2d36de5b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        g2ax_installer_customer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_installer_customer.exe
        • Size 595KB
        • SHA256 d40d64c925624405e0616dc840792a6141ca3f82b8cd7c92193ed9fcab9bed72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        g2ax_installer_customer_admin.exe
        • Path C:\Users\Admin\AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Customer\1737\g2a45D9.tmp\g2ax_installer_customer_admin.exe
        • Size 595KB
        • SHA256 aad58e9e4abd76ac98a4928737deb5d317477124041203ca0d45aa50d6925daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3264-0-0x0000000000400000-0x0000000002812000-memory.dmp
        Download