Analysis
- max time kernel
149s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 16:26
General
- Target 2026-04-24_3b39411c2b8cfdbc333852cc02c859ae_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop_vidar.exe
- Size 20.8MB
- Sample260424-txzm8set5t
- SHA256 8f0b8fa746e921561548f3ab66b07d11b87a2635d58b6fce0e1e3ae8e8c144ce
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_3b39411c2b8cfdbc333852cc02c859ae_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_3b39411c2b8cfdbc333852cc02c859ae_amadey_coinminer_darkgate_elex_gcleaner_glassworm_smoke-loader_stop_vidar.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AppVirtDll_AppName.10433.dll
VirtFiles.db
VirtReg.Prog.dat
memory/4440-51-0x0000000071920000-0x0000000071921000-memory.dmp
memory/4440-53-0x0000000071A20000-0x0000000071A21000-memory.dmp
memory/4440-55-0x0000000076F73000-0x0000000076F74000-memory.dmp
memory/4440-32-0x0000000071AC0000-0x0000000071AC1000-memory.dmp
memory/4440-33-0x0000000071AB0000-0x0000000071AB1000-memory.dmp
memory/4440-37-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-40-0x0000000071A40000-0x0000000071A41000-memory.dmp
memory/4440-39-0x0000000071A50000-0x0000000071A51000-memory.dmp
memory/4440-38-0x0000000076F73000-0x0000000076F74000-memory.dmp
memory/4440-44-0x0000000071900000-0x0000000071901000-memory.dmp
memory/4440-48-0x0000000071A20000-0x0000000071A21000-memory.dmp
memory/4440-49-0x0000000071A10000-0x0000000071A11000-memory.dmp
memory/4440-47-0x00000000719B0000-0x00000000719B1000-memory.dmp
memory/4440-46-0x00000000719C0000-0x00000000719C1000-memory.dmp
memory/4440-45-0x00000000718F0000-0x00000000718F1000-memory.dmp
memory/4440-42-0x0000000071960000-0x0000000071961000-memory.dmp
memory/4440-43-0x0000000071950000-0x0000000071951000-memory.dmp
memory/4440-41-0x0000000071930000-0x0000000071931000-memory.dmp
memory/4440-50-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-36-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-35-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-52-0x0000000076F73000-0x0000000076F74000-memory.dmp
memory/4440-34-0x0000000071AA0000-0x0000000071AA1000-memory.dmp
memory/4440-54-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-57-0x0000000076F73000-0x0000000076F74000-memory.dmp
memory/4440-63-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-62-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-60-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-59-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-58-0x0000000075E31000-0x0000000075E32000-memory.dmp
memory/4440-56-0x0000000076F72000-0x0000000076F73000-memory.dmp
memory/4440-64-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-65-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-68-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-69-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-67-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-66-0x0000000075E10000-0x0000000075F00000-memory.dmp
memory/4440-71-0x00000000005D0000-0x00000000005E9000-memory.dmp
memory/4440-70-0x0000000000BC0000-0x0000000000C17000-memory.dmp
memory/4440-75-0x0000000000BC0000-0x0000000000C17000-memory.dmp
memory/4440-76-0x00000000005D0000-0x00000000005E9000-memory.dmp
memory/4440-77-0x0000000075E10000-0x0000000075F00000-memory.dmp