Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 18:45
Behavioral task
behavioral1
Sample
2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
- Size 2.6MB
- Sample260528-xee3nabv61
- SHA256 e806cbf45a5d3f4416877379470aed41135604d71d16aa796ec4908b7a8a1994
- MD5 53b603569178b0bb9a17a115ca98a050
- SHA1 cdf706b2509b1c5a47edbd7c330c9738348a89e4
- SHA512 975a029ab6fc5a37c14a993ade0299e8e1151d8fd939c7d87c191e398c91c78f81cee065aca08afbbf7570bd25a4978e13299447ed469c6d87697375fa84a93c
- SSDEEP 49152:mTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:mKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1F8C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000f0000000243e0-3.dat CryptoLocker_rule2 - Custom signatureDetection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000f0000000243e0-3.dat CryptoLocker_set1 - Custom signatureUPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral1/memory/3976-0-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/files/0x000f0000000243e0-3.dat UPX behavioral1/memory/2228-4-0x0000000000AC0000-0x0000000000B49000-memory.dmp UPX behavioral1/memory/3976-18-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/2228-20-0x0000000000AC0000-0x0000000000B49000-memory.dmp UPX behavioral1/memory/3976-39-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/2228-40-0x0000000000AC0000-0x0000000000B49000-memory.dmp UPX behavioral1/memory/3976-43-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/2228-44-0x0000000000AC0000-0x0000000000B49000-memory.dmp UPX behavioral1/memory/2228-46-0x0000000000AC0000-0x0000000000B49000-memory.dmp UPX behavioral1/memory/3976-50-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/3976-52-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/3976-57-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/3976-60-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX behavioral1/memory/3976-61-0x0000000000A50000-0x0000000000AD9000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 2228 5652cb48 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 405 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 69 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 160 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 313 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 406 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 142 114.114.114.114 2228 5652cb48 Destination IP 467 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 2 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 4 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 140 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 141 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 207 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 375 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 466 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 70 223.5.5.5 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 205 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 306 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 374 114.114.114.114 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5652cb48 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5652cb48 File created C:\Windows\SysWOW64\5652cb48 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe -
resource yara_rule behavioral1/memory/3976-0-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/files/0x000f0000000243e0-3.dat upx behavioral1/memory/2228-4-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral1/memory/3976-18-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/2228-20-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral1/memory/3976-39-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/2228-40-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral1/memory/3976-43-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/2228-44-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral1/memory/2228-46-0x0000000000AC0000-0x0000000000B49000-memory.dmp upx behavioral1/memory/3976-50-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/3976-52-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/3976-57-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/3976-60-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx behavioral1/memory/3976-61-0x0000000000A50000-0x0000000000AD9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\2624e8 5652cb48 File opened for modification C:\Windows\441210 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5652cb48 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5652cb48 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5652cb48 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5652cb48 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5652cb48 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5652cb48 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5652cb48 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5652cb48 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5652cb48 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5652cb48 - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2228 5652cb48 2228 5652cb48 2228 5652cb48 2228 5652cb48 2228 5652cb48 2228 5652cb48 2228 5652cb48 2228 5652cb48 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeTcbPrivilege 3976 2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeDebugPrivilege 2228 5652cb48 Token: SeTcbPrivilege 2228 5652cb48
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_53b603569178b0bb9a17a115ca98a050_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
C:\Windows\Syswow64\5652cb48C:\Windows\Syswow64\5652cb481⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\5652cb48
- Size 2.6MB
- SHA256 fed60d2b98582eb8393797f766281e2785a95303fca84bc303696ff2fb6753f8
- MD5 d26bce2d627e37c95dcd223fdbfccf64
- SHA1 d20f62f147f160151a9488ebb272c59d141ed5fd
- SHA512 e034d17349562c1dd5f70a861e851b52b088ad212428852edd5b0aeab51cbe0733bc2b4644ea7b6676bee16526239b7364ba2f5c7cc8d0f7db912c38526007ae
- SSDEEP 49152:fTGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:fKkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T121C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH