7eb7d5173c832b63fd325e8d81be4b806ea4d5d0f60b08236240ccb37179907c

General

Target
2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Size 4.5MB
Sample260519-mmfn2set7p
SHA256 7eb7d5173c832b63fd325e8d81be4b806ea4d5d0f60b08236240ccb37179907c
MD5 ab026323a9faf44931b52fc822f3ce73
SHA1 e38135fca50d0fc23c063112df3a9b366ddb85dc
SHA512 a7df265e0660254ec332eb83065596420c01dc9f746ad539dcb3778363ba4292dfe661457b88fa35a3fc8c6661da79259d4e271748e3348fcdf7a4003fb28274
SSDEEP 98304:hQ2vrkVzELXWTbMUZAIMamC1rz2A/VCEb9:9rkVzEGFzHdb9
TLSH
T165268D11B642C9B7E68300709879AF7F04796A294B76D4F3B2EC1E5D9A702C32736B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438\Blob = 5c0000000100000004000000001000000b000000010000005c0000005300650063007400690067006f0020005000750062006c006900630020005300650072007600650072002000410075007400680065006e007400690063006100740069006f006e00200052006f006f0074002000520034003600000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c06200000001000000200000007bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06090000000100000016000000301406082b0601050507030206082b060105050703011400000001000000140000005673586495f9921ab0122a046279a140158821491d00000001000000100000001e1771e068b859b9d2e89ea3a6db0e28030000000100000014000000ad98f9f3e47d753b65d482b3a45217bb6ef5e43820000000010000008e0500003082058a30820372a0030201020210758dfd8bae7c0700faa925a7e1c7ad14300d06092a864886f70d01010c0500305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f7420523436301e170d3231303332323030303030305a170d3436303332313233353935395a305f310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564313630340603550403132d5365637469676f205075626c6963205365727665722041757468656e7469636174696f6e20526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a028202010093bed5365275d80123a01c474249ee63b6b721fdc495d5482b267c145310da79fd2bb72da4d42cfaea32dd49c2b9bd0f483d7b5a9854af9e5d31744f07fc5021dda4cf684f1b12636d25994c2a99f3483061fa817c1ea7084adc3e2b1c1f184c71aa358cadf86ee83b4ad9e59402d6898413aa6dc84f33cc5096379233dc5f88e79f54d948f09843d666fd9f173843c501510bd7e3230f145d5b14e74bbeddf4c8da0337d1d639a121513083b06dd7304e965b91f07024abbf458164430dbd213a2f3ce99e0dcb20b54227ccda6f9bee64309039cd9365812131b52350333722e338edf83130cc45fe62f9d15d32794287df6acc5619404dceaabbf9b5764994f127f891a583e506b3630e80dce0125580a63b66b439872dc8f0d0d114e9e40d4d0ef65d5772c53b1c47569de2d5fb81618ccc4d8090345bb7d71475dcd804489fc0c12888b4e91ccaa7b1f156b77b494c59e52015a8840229fa3894699a49068fcd1f791417120c837ade1fb197eef9977828a4c84492e97d2605a658729b7913d8115faec538623468b286308ef890619e326cf50736cda24c6eec8a36edf2e699154470c37cbc9c39c0b4e16bf783252357d91280e549f0750fef8deb1c9b5428b4213cfc7c0affef7b6b75ff8b1da01905abfaf82b8142e838babbfbaafd3de0f3cadf4e979729edf31856e9a596acbdc39098b2e0f9a2d4a647437c6dcf0203010001a3423040301d0603551d0e041604145673586495f9921ab0122a046279a14015882149300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201002f5c993cfc065e8c942e70ead232318db4f051d5bc0af3649f075ed5c17368647aa2b90ee8f95d852da83745aa28f496055060a9497e9fe29936291344476a9d55203cd89bf10332bada40a173ea83a1b744a60e99019be4bc7fbe13947ecaa61e7680363d84068b3326656dca7e9efe1f8c58387b1a83b10fbc1711bbe606cc63fa81f2814cda0b106ba1fad528a5cf064016ff7b7d185e3912a4539e7e324210a62191a91c4e177c84bc9f8cd1e8dfe651b936473f90b9c7bc02dc5b1c4f0e48c125839c0a3f9eb10333121a27acf7226c24d10141f85803fe2568221f9a5a3c7c6c9e7548f381f166676e4c82c0eeba570e18ef2e9af712d8a06be905a5a1e968f8bc4c3f121e45e852c0a3bf122779b9cc313cc3f63a221603a0c98f66a45ba24dd6812506e976a4000a3ecbcd359be0e138cb6053862842411c4457e8a8adab45e32510bcdb3e6541fb1ba6970febb97479f91ebc1d570d47afc32f9f8746a7eb265a0f5663b562606e00fbe3271122e7fe998f34f5b9e8c39172bdd8c31eb92ef2914451d057cd0c34d54821bfdb13f166254352d2702236cd9fc41c7520ad637263060f0e27ced26a0dbcb5391ae9d1767ad15ce4e749492d553768f01a3a983e54178754e9a62750897b202f3fffbfa18b4a4798ff2b7b493ec32946601842ab3329bac029b91389d3888a39413bc9fda6ed1ff46063dfd22d55018b	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD98F9F3E47D753B65D482B3A45217BB6EF5E438	2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_ab026323a9faf44931b52fc822f3ce73_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Install Root Certificate

1

T1553.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fileinfo2.dat.cab

Path C:\Users\Admin\AppData\Local\Temp\ptdownload00000688.tmp\000009d4.tmp\fileinfo2.dat.cab
Size 119KB
SHA256 76d7e61d763ac31c2db17f712994d6dd73f71586a9881ec54cc0019a793e8539
MD5 0516ace8e7d709b42ddc21027ec48553
SHA1 dec7140387e58c53fe883ea34c504d168621ae41
SHA512 283e59505b0687a80ac9d641d483fb31879014aeddc61af072945d99a45df69ab18fb3093ecbd9504f97d170f9c928a29e90b38fb7b4299aa22acb6671561d20
SSDEEP 3072:g+KxR8Zdq+xRjHd6p7F2behqnm/gBFG+uYHmBMOP8aJZNKG:gLEqehHd6p7cbehNoG+uYHmOslp
TLSH
T164C302A38C609CD3D8172FB9B0C1B63DBD75AAA518C241CAF389C94B67650D40DEE57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing