d86bc9be06b19598e7c374ab58a36d20250aa1c00c4beb105cc7137cdeca9e73

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_a84bf03b031145f6faf74af949a0e22d_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
Size 18.9MB
Sample260602-clkaqsbt91
SHA256 d86bc9be06b19598e7c374ab58a36d20250aa1c00c4beb105cc7137cdeca9e73
MD5 a84bf03b031145f6faf74af949a0e22d
SHA1 eb31924f342efd087ebf19e67eb957096df1a641
SHA512 0ba0c1a87d7c03d81e66ac173d7827137ba4fc9c4b997d6d58e2d43e55844e895a5582e10a86df8ccc434ff6ce2a4a31204379d8d51008df6961469b59516881
SSDEEP 393216:bscre0kumAVlFjXmwO6tEAoQXkW/QZx4qmS0NrqNUt3bhm3kPQx:Rre7ApjXmwO6CA7kL4G0xtLha
TLSH
T10B17BE11F742C076D59101B0987EAB7F462CAF290739C6D7A6D83A2D5E31AD22F35B83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3276	3596	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a84bf03b031145f6faf74af949a0e22d_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a84bf03b031145f6faf74af949a0e22d_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a84bf03b031145f6faf74af949a0e22d_amadey_coinminer_dark-comet_darkgate_elex_gcleaner_glass.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 496
  2⤵
  - Program crash
  PID:3276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3596 -ip 3596
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3596-0-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/3596-1-0x0000000000400000-0x00000000016EE000-memory.dmp