Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 00:21
General
- Target 2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe
- Size 10.7MB
- Sample261024-ank9psws5p
- SHA256 186681f7b2767b201af03e98b6531013fc11625f0963be5fe015941d916c0fe1
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3384-0-0x0000000003050000-0x0000000003051000-memory.dmp
memory/3384-14-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-13-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-15-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-21-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-22-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-26-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-24-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-269-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-58-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-283-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-282-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-281-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-280-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-279-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-278-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-277-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-268-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-265-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-264-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-263-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-262-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-258-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-257-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-23-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-27-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-20-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-19-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-17-0x0000000006570000-0x0000000006770000-memory.dmp
memory/3384-16-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-335-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-349-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-347-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-346-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-345-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-344-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-343-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-341-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-340-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-339-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-338-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-337-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-348-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-342-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-336-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-334-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-351-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-353-0x0000000005D70000-0x0000000005F70000-memory.dmp
memory/3384-355-0x0000000003050000-0x0000000003051000-memory.dmp