Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 03:45
General
- Target 2026-11-01_efb68ec5993916e10b21e720f0d60457_darkgate_elex_glassworm_hijackloader_icedid_silence.exe
- Size 11.1MB
- Sample261102-ebapnaex4x
- SHA256 58be395928f8128a046d42226f8a98a1c252e751bfd6ae0fa6ace0e1e18c4c1c
Malware Config
Signatures
- Family: PEASS, PEASS-ng, Peas
PEASS is an open-source tool for privilege escalation.
- Detects PEASS hacktool 2 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Detects executables manipulated with Fody 2 IoCs
- Detects executables packed with Dotfuscator 2 IoCs
- Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs
- detects Windows exceutables potentially bypassing UAC using fodhelper.exe 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_efb68ec5993916e10b21e720f0d60457_darkgate_elex_glassworm_hijackloader_icedid_silence.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_efb68ec5993916e10b21e720f0d60457_darkgate_elex_glassworm_hijackloader_icedid_silence.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\systeminfo.exe"systeminfo.exe"2⤵
- Gathers system information
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
sqlite.interop.dll
memory/1280-17-0x000001D8D7E30000-0x000001D8D7EE4000-memory.dmp
memory/1280-24-0x000001D8BD9B0000-0x000001D8BD9BA000-memory.dmp
memory/1280-3-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-4-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-1-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-9-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-10-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-11-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-12-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-15-0x000001D8BF2B0000-0x000001D8BF2FA000-memory.dmp
memory/1280-14-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-13-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-16-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-0-0x00007FFF3E14F000-0x00007FFF3E150000-memory.dmp
memory/1280-2-0x000001D8BC8C0000-0x000001D8BD3E6000-memory.dmp
memory/1280-18-0x000001D8BF310000-0x000001D8BF31A000-memory.dmp
memory/1280-26-0x000001D8D8170000-0x000001D8D8332000-memory.dmp
memory/1280-23-0x000001D8BF390000-0x000001D8BF398000-memory.dmp
memory/1280-21-0x000001D8D7F20000-0x000001D8D7F38000-memory.dmp
memory/1280-19-0x000001D8D7EF0000-0x000001D8D7F16000-memory.dmp
memory/1280-20-0x000001D8BF320000-0x000001D8BF328000-memory.dmp
memory/1280-25-0x000001D8D7F40000-0x000001D8D7F58000-memory.dmp
memory/1280-22-0x000001D8BD9F0000-0x000001D8BD9FA000-memory.dmp
memory/1280-27-0x000001D8D8870000-0x000001D8D8D98000-memory.dmp
memory/1280-28-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-29-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-30-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-31-0x00007FFF3DFC0000-0x00007FFF3E964000-memory.dmp
memory/1280-39-0x000001D8DA1F0000-0x000001D8DAD16000-memory.dmp
memory/1280-40-0x000001D8D8510000-0x000001D8D852E000-memory.dmp