Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
07/05/2026, 04:34
Behavioral task
behavioral1
Sample
2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe
- Size 2.9MB
- Sample260507-e7l3kaez3s
- SHA256 078c027b3b26aa85d5763f9599bbccd4fd7625c49c96f90f1de832e1f294b197
- MD5 cd8deb56323626ef7782bd80f23fc636
- SHA1 1daa1aa66580294fab537ecb2106dac8062e249d
- SHA512 ff56f39215473e143442015ef4f568a6938ca21528767ae0ada6a94939d06131d1b40be97873d1648cf9b00066d61eb2a5fa4a7e86b538a58db6ad4a0b01b217
- SSDEEP 49152:9HHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:9nKGEkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1CBD59E31B6818036D1B7467186FA47BBA5257C211721A5CFB3C47B2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x001c00000002a117-2.dat CryptoLocker_rule2 - Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x001c00000002a117-2.dat CryptoLocker_set1 - UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral2/memory/4372-0-0x0000000000110000-0x000000000019C000-memory.dmp UPX behavioral2/files/0x001c00000002a117-2.dat UPX behavioral2/memory/4052-3-0x0000000000180000-0x000000000020C000-memory.dmp UPX behavioral2/memory/4372-25-0x0000000000110000-0x000000000019C000-memory.dmp UPX behavioral2/memory/4052-27-0x0000000000180000-0x000000000020C000-memory.dmp UPX behavioral2/memory/4052-49-0x0000000000180000-0x000000000020C000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 4052 cc6067e4 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 17 114.114.114.114 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Destination IP 18 223.5.5.5 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Destination IP 71 114.114.114.114 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Destination IP 72 223.5.5.5 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Destination IP 1 114.114.114.114 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Destination IP 2 223.5.5.5 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 cc6067e4 File created C:\Windows\SysWOW64\cc6067e4 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cc6067e4 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 cc6067e4 -
resource yara_rule behavioral2/memory/4372-0-0x0000000000110000-0x000000000019C000-memory.dmp upx behavioral2/files/0x001c00000002a117-2.dat upx behavioral2/memory/4052-3-0x0000000000180000-0x000000000020C000-memory.dmp upx behavioral2/memory/4372-25-0x0000000000110000-0x000000000019C000-memory.dmp upx behavioral2/memory/4052-27-0x0000000000180000-0x000000000020C000-memory.dmp upx behavioral2/memory/4052-49-0x0000000000180000-0x000000000020C000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\455f28 cc6067e4 File opened for modification C:\Windows\4ad9a8 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cc6067e4 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing cc6067e4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix cc6067e4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" cc6067e4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" cc6067e4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" cc6067e4 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" cc6067e4 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ cc6067e4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" cc6067e4 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" cc6067e4 - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4052 cc6067e4 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Token: SeTcbPrivilege 4372 2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe Token: SeDebugPrivilege 4052 cc6067e4 Token: SeTcbPrivilege 4052 cc6067e4
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_cd8deb56323626ef7782bd80f23fc636_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_re.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
C:\Windows\Syswow64\cc6067e4C:\Windows\Syswow64\cc6067e41⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\455f28
- Size 916B
- SHA256 8c895f127e662cd9e26259a9ebb39a3690cf4caf75d58af7e0b5cf3f2531b786
- MD5 753562d0e7bad22d4dfa18a02f1d3bab
- SHA1 d80ed8e184f0840301cae9032d38495843a6b35d
- SHA512 a8394e15cd95fef0f8cedce4129d25cbd597009227e61299b10830279af6ae5518960e2753a779d7e9bfb36e8de584ca56e80e868cbe344a8ca0200c7b0fcaab
- TLSH T121115CFF34B5933389A1C01B5CE083B5B437524AC55BFF5DAD42F0412557AD898139E1
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\cc6067e4
- Size 2.9MB
- SHA256 f8551e33015719407edae3b746fef5a004a64287129dbb5adf99ab66f7d43267
- MD5 f4c98f3680235c2cefaa7098edcf1f9a
- SHA1 74a9b5da6744623616c4968c6af7d7ffb2ff0668
- SHA512 7c2d46a37120514e5bc6aab26e15eff24d9244aaeecec94ad570a4aeaddee0f74024335130006323aa8a07d1070d9db2254ad89996f2198d2714a395fd40987e
- SSDEEP 49152:tHHKe2WQX56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:tnKGEkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T19FD59E31B6818036D1B7467186FA47BBA5257C211721A5CFB3C47B2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH