7eb7d5173c832b63fd325e8d81be4b806ea4d5d0f60b08236240ccb37179907c

General

Target
2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Size 4.5MB
Sample260519-mmfn2set7p
SHA256 7eb7d5173c832b63fd325e8d81be4b806ea4d5d0f60b08236240ccb37179907c
MD5 ab026323a9faf44931b52fc822f3ce73
SHA1 e38135fca50d0fc23c063112df3a9b366ddb85dc
SHA512 a7df265e0660254ec332eb83065596420c01dc9f746ad539dcb3778363ba4292dfe661457b88fa35a3fc8c6661da79259d4e271748e3348fcdf7a4003fb28274
SSDEEP 98304:hQ2vrkVzELXWTbMUZAIMamC1rz2A/VCEb9:9rkVzEGFzHdb9
TLSH
T165268D11B642C9B7E68300709879AF7F04796A294B76D4F3B2EC1E5D9A702C32736B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 5c0000000100000004000000001000000f00000001000000300000003f13d09d3d9c0e34359655f0e5825a21518c69617ac82a5c65d17cfe8e8958df5d328ac40821fb5116703b7601e9abfb0b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e438190000000100000010000000d21153f3125a7dbce915d41563f733f420000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fileinfo2.dat.cab

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000ff0.tmp\0000103c.tmp\fileinfo2.dat.cab
Size 119KB
SHA256 76d7e61d763ac31c2db17f712994d6dd73f71586a9881ec54cc0019a793e8539
MD5 0516ace8e7d709b42ddc21027ec48553
SHA1 dec7140387e58c53fe883ea34c504d168621ae41
SHA512 283e59505b0687a80ac9d641d483fb31879014aeddc61af072945d99a45df69ab18fb3093ecbd9504f97d170f9c928a29e90b38fb7b4299aa22acb6671561d20
SSDEEP 3072:g+KxR8Zdq+xRjHd6p7F2behqnm/gBFG+uYHmBMOP8aJZNKG:gLEqehHd6p7cbehNoG+uYHmOslp
TLSH
T164C302A38C609CD3D8172FB9B0C1B63DBD75AAA518C241CAF389C94B67650D40DEE57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.exe

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000ff0.tmp\00001360.tmp\casino.exe
Size 467KB
SHA256 7c16b8e609918ba5d622647489341605b429496391ff294c16cd83ce4dfb3761
MD5 de57868b8f9d529f362d106291d2dcb2
SHA1 155b3924960d609aa41392c241adc0df2555cda4
SHA512 502a0c6fd0c68ecbbd3cd9976192be96ae7af61fe6b9f0264ce513a89bfad75e5dbfae6622d9668fa108a8cc235839a677e821b37f32266034f78981f0e883a6
SSDEEP 3072:SuVRyiz5RGPiM0PRnwz583/nQC2mCUnbPXAiuFLaDN9PBx1ZtSxXIQ8rOy0WR3dw:SuVEiz5wTVWLXAiHJ9J9tSxzqNT4TH
TLSH
T1AFA4DC86B446EF9BF74B4830C8B4DE7642F522BE9EB350B139BC535CD3692632425A07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

casino.exe.cab

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000ff0.tmp\00001360.tmp\casino.exe.cab
Size 115KB
SHA256 9eac889be84f58d22494608c3ce197f7d3edebf91fd191c553565327480ceb56
MD5 94dff8249286aade4fc38459b9a6d4b0
SHA1 632d4daecf5a969b09e30fe80d740a07a8652f25
SHA512 5b639ef71aca8213f2643a8bf9e9659e9601f6bcf9017eadabeede62c9b7591206d64b61023fd3e7c7fdb96f83b75512fa34c2d170ed26cb9c62fc0c5454d8bd
SSDEEP 3072:EerZBVtl+wM4j9G9A2olYDHP2Q04hhyFwpozYOc3SEHwP:EerZ/+B5Lt+54zyupozZPP
TLSH
T113C312561DB5FA4E3EC4E04A299ABB5561399CCC23246E3CB428BFB15C4D1C8F183AD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

replace.exe

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000ff0.tmp\00001360.tmp\replace.exe
Size 144KB
SHA256 b92537777e15f580f3f8da6e3597a2a1960d51749e22735780b61ad86a744c3a
MD5 a644740357fd69e89547219e8e714727
SHA1 0278f6258a03b1cebadca6b5df5c36630c3fc910
SHA512 d1c0b202ff52f38f6b585ebafb70a6f57f590aa48d01c0569238c00e645539bcdc16bea7aaaf020d3545af2ae01968a125924763357ac5d7db2bb72c80610a6b
SSDEEP 3072:TngHzh2vkXPYLLIL5jYjSVubeV3q2+g1/eoIRqBP:0HzhrmL054SR/as
TLSH
T116E37C1178C2C872E0BE1E311974DA65197CF9B01B704EDFA388663A5F746D02A36EB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

replace.exe.cab

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000ff0.tmp\00001360.tmp\replace.exe.cab
Size 69KB
SHA256 77536d51e2137e1e4a5f061160426a047bf5fcef15d893b0788be317d4c1edc7
MD5 e433a60b5d3fd1e3b57cd79641f045ef
SHA1 af4149edeec26ba50232507282d897daef613795
SHA512 43f4e8b1b6729cff3513f8ae30ced1f16b67b0e4c237ae6acb13155b32478f634b07344492a0c3e73f929ff4c97ac60a34124aa3a08ab423bc3077da1315baf2
SSDEEP 1536:BK1V1XGAmTxDJndQmfrLZN5Q4BetVD1RSQRHgaqNaen9Jzul7b5vnXM:BK17QxDVdQ4rLLBefFMNaGubvnc
TLSH
T11263026D5615BBBC4F3F81AEB0AB16F8776D60A84184DA952F7A00DD8014DC062B7BCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads