Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/03/2026, 04:30
General
- Target 2026-03-05_0ec7bc7c5fb0ef0d8bde9ad81aec78b4_coinminer_darkgate_elex_glassworm_maze.exe
- Size 5.7MB
- Sample260305-e42c3scs6q
- SHA256 b565ce47fbcd941362b82417fdbca799bd69f84d87a69d252e7437918ae832ab
Malware Config
Extracted
-
ffdroider
-
http://186.2.171.3
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Ffdroider family
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-05_0ec7bc7c5fb0ef0d8bde9ad81aec78b4_coinminer_darkgate_elex_glassworm_maze.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-05_0ec7bc7c5fb0ef0d8bde9ad81aec78b4_coinminer_darkgate_elex_glassworm_maze.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d
d
d.INTEG.RAW
memory/4292-172-0x00000000052F0000-0x00000000052F8000-memory.dmp
memory/4292-180-0x0000000005950000-0x0000000005958000-memory.dmp
memory/4292-24-0x0000000005430000-0x0000000005438000-memory.dmp
memory/4292-26-0x00000000054F0000-0x00000000054F8000-memory.dmp
memory/4292-29-0x0000000005630000-0x0000000005638000-memory.dmp
memory/4292-30-0x0000000005650000-0x0000000005658000-memory.dmp
memory/4292-31-0x0000000005900000-0x0000000005908000-memory.dmp
memory/4292-32-0x0000000005800000-0x0000000005808000-memory.dmp
memory/4292-33-0x0000000005660000-0x0000000005668000-memory.dmp
memory/4292-38-0x0000000005430000-0x0000000005438000-memory.dmp
memory/4292-42-0x0000000005660000-0x0000000005668000-memory.dmp
memory/4292-44-0x0000000005790000-0x0000000005798000-memory.dmp
memory/4292-49-0x0000000005430000-0x0000000005438000-memory.dmp
memory/4292-53-0x0000000005790000-0x0000000005798000-memory.dmp
memory/4292-55-0x0000000005660000-0x0000000005668000-memory.dmp
memory/4292-14-0x0000000004B10000-0x0000000004B20000-memory.dmp
memory/4292-97-0x00000000052F0000-0x00000000052F8000-memory.dmp
memory/4292-176-0x00000000057F0000-0x00000000057F8000-memory.dmp
memory/4292-101-0x00000000057F0000-0x00000000057F8000-memory.dmp
memory/4292-105-0x0000000005960000-0x0000000005968000-memory.dmp
memory/4292-104-0x0000000005940000-0x0000000005948000-memory.dmp
memory/4292-106-0x0000000005C00000-0x0000000005C08000-memory.dmp
memory/4292-107-0x0000000005B00000-0x0000000005B08000-memory.dmp
memory/4292-108-0x0000000005970000-0x0000000005978000-memory.dmp
memory/4292-113-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-117-0x0000000005970000-0x0000000005978000-memory.dmp
memory/4292-119-0x0000000005AA0000-0x0000000005AA8000-memory.dmp
memory/4292-128-0x0000000005AA0000-0x0000000005AA8000-memory.dmp
memory/4292-6-0x0000000004790000-0x00000000047A0000-memory.dmp
memory/4292-124-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-130-0x0000000005970000-0x0000000005978000-memory.dmp
memory/4292-0-0x0000000000170000-0x0000000000722000-memory.dmp
memory/4292-23-0x0000000005410000-0x0000000005418000-memory.dmp
memory/4292-173-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-98-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-179-0x0000000005930000-0x0000000005938000-memory.dmp
memory/4292-181-0x0000000005D30000-0x0000000005D38000-memory.dmp
memory/4292-182-0x0000000005C30000-0x0000000005C38000-memory.dmp
memory/4292-183-0x0000000005AA0000-0x0000000005AA8000-memory.dmp
memory/4292-188-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-192-0x0000000005AA0000-0x0000000005AA8000-memory.dmp
memory/4292-194-0x0000000005BD0000-0x0000000005BD8000-memory.dmp
memory/4292-199-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-203-0x0000000005BD0000-0x0000000005BD8000-memory.dmp
memory/4292-205-0x0000000005AA0000-0x0000000005AA8000-memory.dmp
memory/4292-247-0x00000000052F0000-0x00000000052F8000-memory.dmp
memory/4292-248-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-251-0x00000000057F0000-0x00000000057F8000-memory.dmp
memory/4292-254-0x0000000005930000-0x0000000005938000-memory.dmp
memory/4292-255-0x0000000005950000-0x0000000005958000-memory.dmp
memory/4292-256-0x0000000005D40000-0x0000000005D48000-memory.dmp
memory/4292-257-0x0000000005C40000-0x0000000005C48000-memory.dmp
memory/4292-258-0x0000000005AB0000-0x0000000005AB8000-memory.dmp
memory/4292-263-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-267-0x0000000005AB0000-0x0000000005AB8000-memory.dmp
memory/4292-269-0x0000000005BE0000-0x0000000005BE8000-memory.dmp
memory/4292-274-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-278-0x0000000005BE0000-0x0000000005BE8000-memory.dmp
memory/4292-280-0x0000000005AB0000-0x0000000005AB8000-memory.dmp
memory/4292-322-0x00000000052F0000-0x00000000052F8000-memory.dmp
memory/4292-323-0x0000000005310000-0x0000000005318000-memory.dmp
memory/4292-330-0x0000000005950000-0x0000000005958000-memory.dmp
memory/4292-329-0x0000000005930000-0x0000000005938000-memory.dmp
memory/4292-326-0x00000000057F0000-0x00000000057F8000-memory.dmp
memory/4292-331-0x0000000005D40000-0x0000000005D48000-memory.dmp
memory/4292-1-0x0000000000486000-0x0000000000487000-memory.dmp
memory/4292-456-0x0000000000170000-0x0000000000722000-memory.dmp