eebe64f9ead96bd929305d3326c34f518dffd910ef90cf9a4977d837563dc613

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Size 2.6MB
Sample260527-vdb89sft3s
SHA256 eebe64f9ead96bd929305d3326c34f518dffd910ef90cf9a4977d837563dc613
MD5 a16cf874a6d295bbedbce652b5aa9be9
SHA1 34071a273f2b62afe5b5280587eccd145172f882
SHA512 4a3e5c05c1fd2bced8ca0921537faecb7fa73e933864c4d8fead6c77368dde1c02d18681535bb2079da75c962a70ebca432f696e6be6c0ae769a286d51d3f155
SSDEEP 49152:5TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:5KkVkOhCXHHFZMjHfUKkVWsM0r1F
TLSH
T131C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x00150000000243e5-2.dat	CryptoLocker_rule2

Custom signature

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x00150000000243e5-2.dat	CryptoLocker_set1

Custom signature

UPX dump on OEP (original entry point) 11 IoCs

resource	yara_rule
behavioral1/memory/2316-0-0x00000000009B0000-0x0000000000A39000-memory.dmp	UPX
behavioral1/files/0x00150000000243e5-2.dat	UPX
behavioral1/memory/2980-4-0x00000000000C0000-0x0000000000149000-memory.dmp	UPX
behavioral1/memory/2316-10-0x00000000009B0000-0x0000000000A39000-memory.dmp	UPX
behavioral1/memory/2980-12-0x00000000000C0000-0x0000000000149000-memory.dmp	UPX
behavioral1/memory/2980-22-0x00000000000C0000-0x0000000000149000-memory.dmp	UPX
behavioral1/memory/2316-27-0x00000000009B0000-0x0000000000A39000-memory.dmp	UPX
behavioral1/memory/2980-28-0x00000000000C0000-0x0000000000149000-memory.dmp	UPX
behavioral1/memory/2980-30-0x00000000000C0000-0x0000000000149000-memory.dmp	UPX
behavioral1/memory/2316-37-0x00000000009B0000-0x0000000000A39000-memory.dmp	UPX
behavioral1/memory/2316-41-0x00000000009B0000-0x0000000000A39000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2980	b5407358

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	1	114.114.114.114	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Destination IP	4	223.5.5.5	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Destination IP	71	114.114.114.114	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Destination IP	72	223.5.5.5	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	b5407358
File created	C:\Windows\SysWOW64\b5407358	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	b5407358
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	b5407358

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2316-0-0x00000000009B0000-0x0000000000A39000-memory.dmp	upx
behavioral1/files/0x00150000000243e5-2.dat	upx
behavioral1/memory/2980-4-0x00000000000C0000-0x0000000000149000-memory.dmp	upx
behavioral1/memory/2316-10-0x00000000009B0000-0x0000000000A39000-memory.dmp	upx
behavioral1/memory/2980-12-0x00000000000C0000-0x0000000000149000-memory.dmp	upx
behavioral1/memory/2980-22-0x00000000000C0000-0x0000000000149000-memory.dmp	upx
behavioral1/memory/2316-27-0x00000000009B0000-0x0000000000A39000-memory.dmp	upx
behavioral1/memory/2980-28-0x00000000000C0000-0x0000000000149000-memory.dmp	upx
behavioral1/memory/2980-30-0x00000000000C0000-0x0000000000149000-memory.dmp	upx
behavioral1/memory/2316-37-0x00000000009B0000-0x0000000000A39000-memory.dmp	upx
behavioral1/memory/2316-41-0x00000000009B0000-0x0000000000A39000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\3304c8	b5407358
File opened for modification	C:\Windows\27a698	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5407358

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	b5407358
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	b5407358
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	b5407358
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	b5407358
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	b5407358
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	b5407358
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	b5407358
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	b5407358
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	b5407358

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2980	b5407358
2980	b5407358
2980	b5407358
2980	b5407358
2980	b5407358
2980	b5407358
2980	b5407358
2980	b5407358
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Token: SeTcbPrivilege	2316	2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Token: SeDebugPrivilege	2980	b5407358
Token: SeTcbPrivilege	2980	b5407358

C:\Users\Admin\AppData\Local\Temp\2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_a16cf874a6d295bbedbce652b5aa9be9_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\Syswow64\b5407358
C:\Windows\Syswow64\b5407358
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b5407358

Path C:\Windows\SysWOW64\b5407358
Size 2.6MB
SHA256 0785a8baf75ad4f4add76b68d611790ef6abcd7f3b5827b424034b2cffacbf3e
MD5 4fcd1348cd509938d60f30f1e246ff29
SHA1 a03d919bb824e291be03c8321b82869c2d8186eb
SHA512 9dac0d8cd2168674bef17fb944ad2ce9ab3f8ce520d9684e11eddd1462107fe727fd25901a61bf41e3481e0375badafb518f938f9e72a8d1ef9ef48c3ee1f38f
SSDEEP 49152:5TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:5KkVkOhCXHHFZMjHfUKkVWsM0r1F
TLSH
T176C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-0-0x00000000009B0000-0x0000000000A39000-memory.dmp

Download

memory/2316-10-0x00000000009B0000-0x0000000000A39000-memory.dmp

Download

memory/2316-27-0x00000000009B0000-0x0000000000A39000-memory.dmp

Download

memory/2316-37-0x00000000009B0000-0x0000000000A39000-memory.dmp

Download

memory/2316-41-0x00000000009B0000-0x0000000000A39000-memory.dmp

Download

memory/2980-4-0x00000000000C0000-0x0000000000149000-memory.dmp

Download

memory/2980-12-0x00000000000C0000-0x0000000000149000-memory.dmp

Download

memory/2980-22-0x00000000000C0000-0x0000000000149000-memory.dmp

Download

memory/2980-28-0x00000000000C0000-0x0000000000149000-memory.dmp

Download

memory/2980-30-0x00000000000C0000-0x0000000000149000-memory.dmp

Download