aa4f6253046c5f0dc3c4d4864571932fec699ed4b8641280740816fb90bc1cb4

General

Target
2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Size 1.1MB
Sample260509-wrfdhsbv4x
SHA256 aa4f6253046c5f0dc3c4d4864571932fec699ed4b8641280740816fb90bc1cb4
MD5 0ce99d09c5eb97dc359092ef3750a0de
SHA1 2ae858f1d383cbd50f39770d5933727a0472f777
SHA512 ec4827b717f34c2b75107e3453b035d8d8bb420887d9d0ebbdbb36802cc403febf39daba3c5eace18662a799fda10577530986447979b4f47fcab8a92a69850e
SSDEEP 24576:RvO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:RHHKO29QGhuTtS0rQi
TLSH
T1CE359E31E241C036D4A70176C6B94BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2432	3b2c863c

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	2	223.5.5.5	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	8	114.114.114.114	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	9	223.5.5.5	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	3b2c863c
File created	C:\Windows\SysWOW64\3b2c863c	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	3b2c863c
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	3b2c863c

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\29a300	3b2c863c
File opened for modification	C:\Windows\42b370	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3b2c863c

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	3b2c863c
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	3b2c863c
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	3b2c863c
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	3b2c863c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	3b2c863c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	3b2c863c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	3b2c863c
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	3b2c863c
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	3b2c863c

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
2432	3b2c863c
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeTcbPrivilege	3896	2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeDebugPrivilege	2432	3b2c863c
Token: SeTcbPrivilege	2432	3b2c863c

C:\Users\Admin\AppData\Local\Temp\2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_0ce99d09c5eb97dc359092ef3750a0de_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\Syswow64\3b2c863c
C:\Windows\Syswow64\3b2c863c
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3b2c863c

Path C:\Windows\SysWOW64\3b2c863c
Size 1.1MB
SHA256 ce7b78c3ab1427bb08d605b368f632105a11b3fb37eeac477f0515062cb76efb
MD5 e60c3e89c41e6e83e7248520c1466ffd
SHA1 3431aa26f716f65cb3518b427c273955ddf6f242
SHA512 8b081930eb79de5ed6a47e43c3785f9fe0353f3b753156af895fcf38bcf0e0d182c115063b3d4554a6a9dab644c71f446e973ceca2db41e5779ef4b1283ce6d5
SSDEEP 24576:SvO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:SHHKO29QGhuTtS0rQi
TLSH
T183359E31E241C036D4A70176C6BA4BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-4-0x00000000007F0000-0x0000000000853000-memory.dmp

Download

memory/3896-0-0x0000000000BF0000-0x0000000000C53000-memory.dmp