27501ea982f0e7dd9a3c52b6ad4474740df11fc1871cf2d06d4868eb2a3cc6cd

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_c30eb61b9ce0cc1f4f25e6b6cd2ff57b_amadey_coinminer_darkgate_elex_gcleaner_remcos_smoke-loader.exe
Size 6.2MB
Sample260629-dp4dfsc14k
SHA256 27501ea982f0e7dd9a3c52b6ad4474740df11fc1871cf2d06d4868eb2a3cc6cd
MD5 c30eb61b9ce0cc1f4f25e6b6cd2ff57b
SHA1 d65b1d369d5cf0bc196c9d4d62c59df6afc2fe4c
SHA512 2eb346ae95b6f35f192425c547e769376a4a543db39a6f7d71f5781139f62d306700975f6bbddd307b2f9e5df12acff77ffab18bff378fe696e08db57ba614d7
SSDEEP 98304:Dy4JVHQh2uuiCQ28AdG7TIqPFSteAVwkG:eQZ5rG4eAVwk
TLSH
T1DA568C21F381C437D06312B49A6A93AD6979BE301B3655C336EC6B1EAF752C12F35287
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000400000-0x0000000000A2D000-memory.dmp	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000400000-0x0000000000A2D000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_c30eb61b9ce0cc1f4f25e6b6cd2ff57b_amadey_coinminer_darkgate_elex_gcleaner_remcos_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_c30eb61b9ce0cc1f4f25e6b6cd2ff57b_amadey_coinminer_darkgate_elex_gcleaner_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c30eb61b9ce0cc1f4f25e6b6cd2ff57b_amadey_coinminer_darkgate_elex_gcleaner_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5076-0-0x0000000000400000-0x0000000000A2D000-memory.dmp

Download

memory/5076-1-0x0000000000400000-0x0000000000A2D000-memory.dmp