62a0cedbdebadd035d26e084b9e7cd285424be63a6832f16fed40496ba3149e2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/05/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
Size 8.6MB
Sample260527-vr61ssdz7l
SHA256 62a0cedbdebadd035d26e084b9e7cd285424be63a6832f16fed40496ba3149e2
MD5 b2b268ca42b975ada0b90cd7586e0dd1
SHA1 1eda4cf02127b239f313bcc4999affd3ff8a0e19
SHA512 e32853a4bc0ee2e9b227dc01db73b54db5a0daf886129c50d97362aa366ba0b24631301019885cfc744ea18a7c764e79ddd8b55eccd9820fd6e612f63de5e833
SSDEEP 196608:c0zRQPU8sHG+LQVm7pd7RjlY/6XPe2sia6uQgeUhdluV6U:cuaDsm+LQVm7XFjlJPjsi9MRhdl+
TLSH
T1A59633E1E6520077E08111349A175B65AE38A732876E41C3B7DCB9DA3F703E17B78A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery upx

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	mDNSResponder.exe

UPX dump on OEP (original entry point) 18 IoCs

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x00000000005F5000-memory.dmp	UPX
behavioral1/files/0x0008000000024593-17.dat	UPX
behavioral1/files/0x0007000000024597-23.dat	UPX
behavioral1/memory/4380-25-0x0000000010000000-0x0000000010627000-memory.dmp	UPX
behavioral1/memory/2188-28-0x0000000000400000-0x00000000005F5000-memory.dmp	UPX
behavioral1/memory/1072-29-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-31-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-32-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-33-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-34-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-35-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-36-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-40-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-43-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-44-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-45-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-46-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX
behavioral1/memory/1072-47-0x0000000000400000-0x00000000012C8000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0007000000024597-23.dat	acprotect

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	INIT_t.exe

Executes dropped EXE 3 IoCs

pid	Process
4628	mDNSResponder.exe
3464	mDNSResponder.exe
1072	INIT_t.exe

Loads dropped DLL 2 IoCs

pid	Process
4380	regsvr32.exe
404	regsvr32.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/files/0x0008000000024593-17.dat	upx
behavioral1/files/0x0007000000024597-23.dat	upx
behavioral1/memory/4380-25-0x0000000010000000-0x0000000010627000-memory.dmp	upx
behavioral1/memory/2188-28-0x0000000000400000-0x00000000005F5000-memory.dmp	upx
behavioral1/memory/1072-29-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-31-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-32-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-33-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-34-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-35-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-36-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-40-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-43-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-44-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-45-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-46-0x0000000000400000-0x00000000012C8000-memory.dmp	upx
behavioral1/memory/1072-47-0x0000000000400000-0x00000000012C8000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mDNSResponder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INIT_t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mDNSResponder.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\TypeLib\ = "{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\ = "_DRASplus_Watch"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\TypeLib\ = "{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASPLU~1.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASPLU~1.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\ = "_DRASplus_Watch"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63E7D46A-015A-4924-8132-FA723B428643}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ = "RASplus_Watch Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASPLU~1.OCX, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASPLU~1.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Control\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ProgID\ = "RASPLUS_WATCH.RASplus_WatchCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\TypeLib\ = "{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\ = "RASplus_Watch ActiveX ÄÁÆ®·Ñ ¸ðµâ"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RASPLUS_WATCH.RASplus_WatchCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RASPLUS_WATCH.RASplus_WatchCtrl.1\ = "RASplus_Watch Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RASPLUS_WATCH.RASplus_WatchCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASPLU~1.OCX, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\ = "_DRASplus_WatchEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\MiscStatus\1\ = "131473"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RASplus_Watch.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DEA2CC1-8BB2-4DAA-A876-460030FAB5B0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FEEF26FA-3827-49D2-877A-711DA606EFA9}\ = "RASplus_Watch Property Page"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\ = "RASplus_Watch Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC894766-86B5-4B07-A1B8-A62247B1B48A}\TypeLib\ = "{313AB0EC-2B95-4008-AB1D-A25EE93CB10B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63E7D46A-015A-4924-8132-FA723B428643}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1072	INIT_t.exe
1072	INIT_t.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1072	INIT_t.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2188	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
2188	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
1072	INIT_t.exe
1072	INIT_t.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4628	2188	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe	87
PID 2188 wrote to memory of 4380	2188	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe	91
PID 2188 wrote to memory of 1072	2188	2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe	92
PID 1072 wrote to memory of 404	1072	INIT_t.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_b2b268ca42b975ada0b90cd7586e0dd1_amadey_coinminer_elex_glassworm_smoke-loader.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Users\Admin\AppData\Local\Temp\mDNSResponder.exe
  C:\Users\Admin\AppData\Local\Temp\mDNSResponder.exe -install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4628
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\RASplus_Watch.ocx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\INIT_t.exe
  "C:\Users\Admin\AppData\Local\Temp\INIT_t.exe" 0 29
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\System32\regsvr32.exe" /s "RASplus_Watch.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:404

C:\Users\Admin\AppData\Local\Temp\mDNSResponder.exe
C:\Users\Admin\AppData\Local\Temp\mDNSResponder.exe
1⤵
- Modifies firewall policy service
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

INIT_t.exe

Path C:\Users\Admin\AppData\Local\Temp\INIT_t.exe
Size 3.6MB
SHA256 3e30005cc840015489828121f06ff93d3141524d0b7d687eae39d097f4c4e5dc
MD5 597cbcda2130bccb7d4a81751b4e7cf8
SHA1 45c6007a4b31b7a8fb2046a04d85bf4caeea1ac4
SHA512 5c4f0c927576933fd04862eff5092b3fc40d3836d77f3dc19b5224e6eed6004a09d570ac7590ec2c7aeb5b4517e5ed32128c0a7f04cb698f1eb4a1309772d4e6
SSDEEP 98304:sQPXUHkdsHoPM/L3gVmIM2STpuEZRQQiwbYpiYkI:sQPU8sHG+LQVm7pd7RjlY/
TLSH
T1950633F8DB1100FFE25C513009175F80AA25BBA2C9BCCB91C22AB54BB8757716D91F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RASplus_Watch.ocx

Path C:\Users\Admin\AppData\Local\Temp\RASplus_Watch.ocx
Size 1.5MB
SHA256 c118e92cf8175c1b8f828f4073db5bd82ac5f608cdfbe862a965c43b1a94a0e7
MD5 c650558350e49adee3edf0a4f796a772
SHA1 ff92fd43d4d2208fe319db749922cca9b261f999
SHA512 73df2f93dcaef5cf0679707d34e0db9faf7f0df8a27ba84af97ad501a222978d500d25db3ad1b1c9327a0f025ea61c0a727d6222e7a6cebb118b5de8ebf57f32
SSDEEP 24576:WG1H4SIwF736Jknz49OwSTHsV7ZhkZlc+f9iQraKPy7VPIbL9:ZY9236Jkk9xYsnQra0b5
TLSH
T14365334FE19EA445FC8D003C5A164ACFDE9ADFD81FBC3185C454F5CEA1B2670A36A229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mDNSResponder.exe

Path C:\Users\Admin\AppData\Local\Temp\mDNSResponder.exe
Size 381KB
SHA256 10f21999ff6b1d410ebf280f7f27deaca5289739cf12f4293b614b8fc6c88dcc
MD5 db5bea73edaf19ac68b2c0fad0f92b1a
SHA1 74bb0197763e386036751bf30c5bbf4c389fa24e
SHA512 63b718288c266debf3f58ac1a62cdcca6f09350616d53a406271d8f4fe6144751eddf7b7ba2dbfe79cfda671ee5afbdbae5798204edaaf4f0391895b824ae7c5
SSDEEP 6144:Zcc4coSV94WrUk4nIJorxKwnvQTfdkxygK5vcdiXphuYcVHaXlFHCe9oK28ruyL2:MzSVPYk4drxKw4TfwcMi7uYZ9A
TLSH
T136848EA2E2814071E4D31232EE75AB359E3D9735232A10C7A7D84EE82D645E2FB7C357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-43-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-35-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-47-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-46-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-29-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-31-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-32-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-33-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-34-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-45-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-36-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-40-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/1072-44-0x0000000000400000-0x00000000012C8000-memory.dmp

Download

memory/2188-0-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/2188-1-0x00000000005F4000-0x00000000005F5000-memory.dmp

Download

memory/2188-28-0x0000000000400000-0x00000000005F5000-memory.dmp

Download

memory/4380-25-0x0000000010000000-0x0000000010627000-memory.dmp

Download