94ea804de8d0ab9f6d915b2d695d574fa7405ed6ee57f15b31f9bd752005788e

General

Target
2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Size 4.0MB
Sample260517-ef9pjsb18y
SHA256 94ea804de8d0ab9f6d915b2d695d574fa7405ed6ee57f15b31f9bd752005788e
MD5 6b794eb2baa5d9979677736ddc9eba6b
SHA1 e1a0c6693aaa91c74be430febc397c5678186da5
SHA512 de69d9c030f50544d99b88207c2445b0489180519d8c04b55c89007b82a9ee14f34e44dfad4c6d2fb7109a78489b38ca96c6eb6c8f9e874f2b6dfb0213291572
SSDEEP 98304:pnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:pCNDtojKL2Kqo7
TLSH
T18F16CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000024273-2.dat	INDICATOR_EXE_Packed_VMProtect

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000024273-2.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
968	ed4b3ea8

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	2	223.5.5.5	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	39	114.114.114.114	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	42	223.5.5.5	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	1	114.114.114.114	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	ed4b3ea8
File created	C:\Windows\SysWOW64\ed4b3ea8	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ed4b3ea8
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ed4b3ea8

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\109290	ed4b3ea8
File opened for modification	C:\Windows\280fc8	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed4b3ea8

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ed4b3ea8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ed4b3ea8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ed4b3ea8
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ed4b3ea8
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ed4b3ea8
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ed4b3ea8
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ed4b3ea8
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ed4b3ea8
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ed4b3ea8

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
968	ed4b3ea8
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeTcbPrivilege	2340	2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeDebugPrivilege	968	ed4b3ea8
Token: SeTcbPrivilege	968	ed4b3ea8

C:\Users\Admin\AppData\Local\Temp\2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_6b794eb2baa5d9979677736ddc9eba6b_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Windows\Syswow64\ed4b3ea8
C:\Windows\Syswow64\ed4b3ea8
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ed4b3ea8

Path C:\Windows\SysWOW64\ed4b3ea8
Size 4.0MB
SHA256 3f59426213d0348e5228184bd8003a76326f7a8f2a6348f7ad59f07adbc22655
MD5 25457dd02c5f7011d094defc823d0ba5
SHA1 e8746c9cd3dce5cb362e826fd7835336b22d4fd4
SHA512 7b4e9ec8e9398e42d5eac68dec3d4172b048213204f18db8b8d0bba2bd71e821001662264016de183cad9cb443f2b85932f1bb8fd7e5550030c89a8e530727e7
SSDEEP 98304:rnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:rCNDtojKL2Kqo7
TLSH
T1BF16CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-4-0x0000000000DD0000-0x0000000000E33000-memory.dmp

Download

memory/2340-0-0x0000000000330000-0x0000000000393000-memory.dmp