Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 00:21
General
- Target 2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe
- Size 10.7MB
- Sample261024-ank9psws5p
- SHA256 186681f7b2767b201af03e98b6531013fc11625f0963be5fe015941d916c0fe1
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_b021df2d94fcf64d3a526375bf9a814b_amadey_coinminer_darkgate_elex_glassworm_redline-stealer.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3156-0-0x0000000003430000-0x0000000003431000-memory.dmp
memory/3156-12-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-14-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-15-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-20-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-16-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-23-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-24-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-31-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-28-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-29-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-30-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-25-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-27-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-26-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-37-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-40-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-42-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-41-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-39-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-38-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-36-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-35-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-34-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-33-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-32-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-46-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-51-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-53-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-50-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-49-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-48-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-47-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-61-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-60-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-59-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-66-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-69-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-77-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-82-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-81-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-80-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-79-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-78-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-76-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-75-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-74-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-73-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-71-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-70-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-68-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-67-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-65-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-64-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-63-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-62-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-58-0x0000000006B60000-0x0000000006D60000-memory.dmp
memory/3156-55-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-56-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-57-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-54-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-52-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-45-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-44-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-43-0x0000000007360000-0x0000000007560000-memory.dmp
memory/3156-355-0x0000000003430000-0x0000000003431000-memory.dmp