Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/05/2026, 04:27
Behavioral task
behavioral1
Sample
2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
- Size 2.6MB
- Sample260509-e3cckaaw4w
- SHA256 3718c5c5fd72621a06e826781e578a5486099c3d7a65ddbe845de2a67dd9cfc6
- MD5 48daedb10be6a02fc6d4c719ffcd58b2
- SHA1 a65b5af6e21206d951620768583e61fd08b38d6b
- SHA512 0f12f5c61f38ce6e5761c501e6cde3ffc7d9e8ec41619cdf65bfc833b6fe3731db0574b315de0e71562721e53b937cfaffb2cbc6f9417d5b13685f45925265d7
- SSDEEP 49152:xTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:xKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T12DC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x009800000001b598-2.dat CryptoLocker_rule2 - Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x009800000001b598-2.dat CryptoLocker_set1 - UPX dump on OEP (original entry point) 12 IoCs
resource yara_rule behavioral1/memory/4832-0-0x0000000000C60000-0x0000000000CE9000-memory.dmp UPX behavioral1/files/0x009800000001b598-2.dat UPX behavioral1/memory/3008-4-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/4832-15-0x0000000000C60000-0x0000000000CE9000-memory.dmp UPX behavioral1/memory/3008-18-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/3008-27-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/4832-38-0x0000000000C60000-0x0000000000CE9000-memory.dmp UPX behavioral1/memory/3008-39-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/3008-43-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/3008-45-0x00000000002E0000-0x0000000000369000-memory.dmp UPX behavioral1/memory/4832-47-0x0000000000C60000-0x0000000000CE9000-memory.dmp UPX behavioral1/memory/4832-58-0x0000000000C60000-0x0000000000CE9000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3008 244ffe27 - Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 164 223.5.5.5 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 4 223.5.5.5 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 47 114.114.114.114 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 50 223.5.5.5 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 92 114.114.114.114 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 94 223.5.5.5 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 231 114.114.114.114 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 232 223.5.5.5 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 3 114.114.114.114 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 163 114.114.114.114 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C 244ffe27 File created C:\Windows\SysWOW64\244ffe27 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 244ffe27 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 244ffe27 -
resource yara_rule behavioral1/memory/4832-0-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral1/files/0x009800000001b598-2.dat upx behavioral1/memory/3008-4-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/4832-15-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral1/memory/3008-18-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/3008-27-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/4832-38-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral1/memory/3008-39-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/3008-43-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/3008-45-0x00000000002E0000-0x0000000000369000-memory.dmp upx behavioral1/memory/4832-47-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx behavioral1/memory/4832-58-0x0000000000C60000-0x0000000000CE9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\337f80 244ffe27 File opened for modification C:\Windows\52b9c0 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 244ffe27 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 244ffe27 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 244ffe27 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 244ffe27 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 244ffe27 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 244ffe27 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 244ffe27 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 244ffe27 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 244ffe27 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 244ffe27 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3008 244ffe27 3008 244ffe27 3008 244ffe27 3008 244ffe27 3008 244ffe27 3008 244ffe27 3008 244ffe27 3008 244ffe27 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeTcbPrivilege 4832 2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeDebugPrivilege 3008 244ffe27 Token: SeTcbPrivilege 3008 244ffe27
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_48daedb10be6a02fc6d4c719ffcd58b2_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
C:\Windows\Syswow64\244ffe27C:\Windows\Syswow64\244ffe271⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\244ffe27
- Size 2.6MB
- SHA256 f53e4cf9dd3382b5e3250bbd7a41c2a50f68a5fdd0f93c1b67ea3eb501467742
- MD5 42d0d50bf6b0bac73d452338a83b8e30
- SHA1 d1948c58e4b4ef09f1c049d4efcdf2d03e7a9d14
- SHA512 cdadf2b761820b449387e73007967832cb55a768eb0c3cce2d91a771499bc21fd3cd09552f4108944b529663b6fe7f08c419785af97330ed2c330d428edf6d98
- SSDEEP 49152:yTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:yKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T194C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH