6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
Size 30.5MB
Sample261030-ppynray13k
SHA256 6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd
MD5 fac03f5bde33381a9c902ca83faa5197
SHA1 f9681c50a0fbf05ae0f71f8c310e20317c1c307f
SHA512 322c90da9c30bf961b1dfeb08f698af11b200c2cf9f8001b47f7c4e7f0a8a32498d30d963cbd9d4f4d6f70f47622785e41b919efcf0f49bb40e2f0f5c4056df1
SSDEEP 393216:xsf2uaAqxl5OxsZ0gesZ0gd1zioZs/huPBqClYgIy9uNR9hNs2:xk8/R+sOrsOG/ZNKgmfHi2
TLSH
T18A678C0262D88816E1721A36DCB9DAE4562A3D601F74D4DF3BC82ACC6D79BC0BE71753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4260	GameCenter.exe

Loads dropped DLL 7 IoCs

pid	Process
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	GameCenter.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	GameCenter.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameCenter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\GameCenter\GameCenter.ini:Tamper	2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Local\GameCenter\GameCenter.ini:Tamper	GameCenter.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4260	GameCenter.exe
4260	GameCenter.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe
4260	GameCenter.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4260	4696	2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Users\Admin\AppData\Local\GameCenter\GameCenter.exe
  "C:\Users\Admin\AppData\Local\GameCenter\GameCenter.exe" -startedbysetup "installer=C:\Users\Admin\AppData\Local\Temp\2026-10-30_fac03f5bde33381a9c902ca83faa5197_amadey_darkgate_elex_gcleaner_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe" game=13.2000009 -removeifinstallcanceled
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zxa.dll

Path C:\Users\Admin\AppData\Local\GameCenter\7zxa.dll
Size 155KB
SHA256 f6b9ae6eaaedc55db0e381ec153892c122f1f257ada80cf242a20be8a2f117ef
MD5 ad71a5e3a757aef0329aeda567f25a00
SHA1 97c766d85c9dabfcabd5a983fe165506d227a8ac
SHA512 6852496fb8f59bea3ae46efd507d654ae27306d9f4f2f0dc0db8b03f9f63a3712e075b12f0ebdf6ea88db081fca4dd29be1555584aa70386ccb8297beef886ea
SSDEEP 3072:0qNymKJ1/fi2YrR4qzoSB6PVx/lhpwp8Gn9XA6kuF:qJ0rR4qmPVvf88uAdm
TLSH
T184F3AE2173FA80FAD24A31315A1D7FBA56BEE3484F1449C76300EE5A6E319E5E23D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BigUp2.dll

Path C:\Users\Admin\AppData\Local\GameCenter\BigUp2.dll
Size 2.5MB
SHA256 5df1fd7a47c6cc0fa503aa6ebf71b7133f7d6dd1403298c380d5b77adcad6cb1
MD5 63ace3d80ef4d8c399dd0da2eb837d2c
SHA1 87fdff5601d2bfe76dac5351729f538cc522fe79
SHA512 e40ad148a6c4428ebbacc43be84fb193f1db60d11199eee6f1368a75bc5a3564b87ee9748b551b8d917c26af5cf1d605634d7bf6627ef0b87c459f0c3a7b0c90
SSDEEP 49152:ZJZhmSbuBtgOYo8pqZo9v+q4D8DhONOZZ5eo1gZYNKX16jjG05veDQht:d82uaUo9vhco1gmNM6jB
TLSH
T153C55A307A17C13FCA9E02B1683CDA5F845C6B991B3458D7E2D85F6EA9784C31632D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameCenter.exe

Path C:\Users\Admin\AppData\Local\GameCenter\GameCenter.exe
Size 9.3MB
SHA256 3868b17790a115a465b942436f404201d1572bc94d96f54bf93a3b10e00767b5
MD5 9bb75688df2a8e9753652879df242e05
SHA1 23158d520ba5a4506341900d47a38d1fb9daa3b7
SHA512 036db1c54ec7f28bc150fd6762aec85bb72c44859a26e121186fb5f387f251c20a2e853d6bc28022cfae8d82ac30a96e79547960bbdc55489eda69898d8920a4
SSDEEP 98304:AMFlv9AoZbEAL3yz+qtsYhH3VYvPgPZnWcBJL18qyULCZtX0ZSO/v9ved:/FlvioZuz/hHyvPBqUcZ/5ed
TLSH
T142A6B21263E88816F2B31F379DBADAD469297D311E38D40F3B886B4C5D39B41ED21762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameCenter.ini

Path C:\Users\Admin\AppData\Local\GameCenter\GameCenter.ini
Size 326B
SHA256 4623a9c32bf080863c909fc42e81bf2112dceed9f1bb91780179f59dd4d8e84f
MD5 d5970dc40076449a0310ac467ee171d3
SHA1 08a94db7c656592a451118a493579f3592e089ce
SHA512 a90e42e74055c93952f32d2fe0557286ceb909eeb6c9eb113e1f73f25fc36a2da2fbf79cf8baa466cf3728eefb9bacfcc1dd12af32fd56f07f1766b133aa41a5
TLSH
T176E07D3428EB015D903B67CE09BCB239A3F422D781E14810F3FC1119AF740245D09627
MD5 SHA1 SHA512 TLSH

Submit Download

LightUpdate.dll

Path C:\Users\Admin\AppData\Local\GameCenter\LightUpdate.dll
Size 250KB
SHA256 a4e5081a86abc8a82b6157e5a54fe76669159f70c8056d51c09c9ffb87eb97c6
MD5 f1ec86626e9368c58019c055e5834ffa
SHA1 0c04d92a8c2dd8bd4d556fdb89f0f2f4c5e2a5ea
SHA512 245811e56e8e1f1e79edf9fee8ccff0ab67210cef8ce806ddb6aa90a8ab19ba29bfc946ef357a5c68e44dbbc7478c5541ec7919880c87bb3b7144657e541f3a0
SSDEEP 3072:gs/YlxsnDVp94/YLhX7QGZinYRHIi22F/v6vcEaK0Ag0FubdjSvNx3ls8+8JAomi:gAP9jR51HIi2Bf0AOlK3VL+s
TLSH
T164449D007841C033E5BE05314979EBA6497CB9600BA4CAEFA7EC5D6E5EB53C12731AB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkiAcc.dll

Path C:\Users\Admin\AppData\Local\GameCenter\SkiAcc.dll
Size 2.7MB
SHA256 8d8d07463f8915a923058e3a5a60ace1fda7ae9cdebb97b5c6aa05ccbd9b2ea1
MD5 636c2b64ecd58ffe84622d0e0d0597bc
SHA1 b3b7aacb8914ffaca082c4d68f05997d7f2a7880
SHA512 96e36ce5d66afd31170a3fa4df4b676e99451ace3788c44602e1d09e3db3473701e5155edc297fa3ddd270172539532f8ad87fd828649c558bd87e1cb383b5d8
SSDEEP 49152:j5IeOteTw+9rsHutkg7kKR8f7iC35k0J7K+tG+9RmuyETmlc:GdtatOu6g7kKR4+0Xmuulc
TLSH
T1F6D55B80E1E364B4CA861570FD2DB52FAB24325D47F989F7F6E059E0B9322C13AB3945
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\GameCenter\libcurl.dll
Size 496KB
SHA256 c4cd25b0ed760b4d6a7801af7747e3ac2d00251791c500f17fbfe86b216d24f1
MD5 e2f8b96a05bfc60589db5015380a7b0a
SHA1 8f83ddb46b14993464d2b42e472a9bd25f0cae66
SHA512 bebf8efefcfd14fd1656a45d90170b620e12334feb827103229c1cde2dfca475df5a9a5cb268dc934907cda9cd62a81a2d23b69cd9a06fcc9f603ba929a56b6f
SSDEEP 12288:FBBxYl1vy06gBUmEUN9i6QhU1bZohLMjpR4dFZA2mXbzKzxd1qEYRcH2PIGkbA60:FDxQ6xP1KcHKSAh
TLSH
T131B48E53BE81C2F2E1CA107851B297371D38552AD714DAC3E3B455E9DE302E2A63E78E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.log

Path C:\Users\Admin\AppData\Local\GameCenter\main.log
Size 903B
SHA256 c2b593e59793e22c3198a83e7976e0cecbc323a334b3d02c3e0b9189f61786ed
MD5 9deb8e39febd12f9555df7e2cc4d90a5
SHA1 b553744a404f23b72d459ef5ea748e8870bd8751
SHA512 9c3a019a96a93787a843cdcac09e6ae2e14ed5da4efb02cb253ec2ae41606f46701de288a912f0af3d2302fe009b68cc133b09be6a7b4142805a14f84d9ecfa3
TLSH
T148119005C255CAE40C9EB46732BABDCED615346DB6248E105348F68F53D286F3CCAF02
MD5 SHA1 SHA512 TLSH

Submit Download

preinstall.brs

Path C:\Users\Admin\AppData\Local\GameCenter\preinstall.brs
Size 6.6MB
SHA256 239f0c2cb6ecd163e51da31634e46224445fc2337183fa479577be37e7ef331d
MD5 49f8e108eeb0fba1fc5b0e3fef3432ee
SHA1 07cbcf5773fc6c581e8f938914b22ccc2bfabbc6
SHA512 c339a4193e0dda2055883f57a6663c26228162a39b10a18b0dc923aef17e6cb2ccd9103bed7c82e823ec22b2d1f61c1429dcfc5f898a7eebd3e93811b6881718
SSDEEP 98304:2cdlLC7VCLiAV5Z6ErpUNU+z33TSRDXR60eeIrsFrpUNU+z33TSRDXR60eeIrs:26iALxsU+zQY7e5JsU+zQY7e5
TLSH
T1BF66EF447C95A881A84DB66CE0FCD845C7F72ED10C74052EAFEADD960E12E8C8DE58DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pxd.dll

Path C:\Users\Admin\AppData\Local\GameCenter\pxd.dll
Size 81KB
SHA256 43fc9d41a43f67304f00aa95540e3854f3ad31c4ad30ea99f04e41ef9fc318a0
MD5 67245252b3545085d69ecfb878d7e0ae
SHA1 d2b4464f2c8d1e5bc9085a5016a8316241f13c23
SHA512 c4c6f418101fd6ef0690c73276b3ace7317c1a3af9cdcd401028cb64f37979151aaccf5e33e671aecd62019e51f334b84d1e40bdd17018b2655f944c11f3f3e1
SSDEEP 1536:iLyf5ph3SS5y3hbvP8/DDKcfLD0pSGU9JKw5ri8p8i83h8cjomwW3hbC:iLpS5maDDKcfLAENKw5ri8p8i7cjomwV
TLSH
T1C1837C8577919077D5C39E79A1F8D3B24C3EBA41A7F810CB2B791155AED03C02B7832A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\GameCenter\zlib1.dll
Size 141KB
SHA256 b3d9ec3c9854504d16acfb40396b9ad014c6552a9c460a07a9e895e8d2da9caf
MD5 96a7bd8901a727706aefeffcbad16604
SHA1 8441e01ad740fb28590effbd0b3136626fce55d5
SHA512 e18b508c41ec19b024e8cd03ff9d6070a8fbe79d19ea99c3e633b25ad3a8230da8a2ed8382cbfe1e7e12f5774ae78c260592a2935da203bf7649d156dce5b767
SSDEEP 3072:RwiXECLjT5j0X7TszcY4TBfqGbHlAMApck5:/UCL/5jrcY4TByGbSpv
TLSH
T12EE39E0176C2C175D1B7423186F8DB1ADB3D7D220B3799DF6388769A09312C1A638BFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4260-70-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/4260-110-0x0000000000400000-0x0000000000D89000-memory.dmp

Download

memory/4260-111-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/4696-47-0x0000000000B30000-0x00000000029B4000-memory.dmp

Download