Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 01:40
Behavioral task
behavioral1
Sample
2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Resource
win11ltsc2024-20260630-en
2 signatures
150 seconds
General
- Target 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
- Size 2.3MB
- Sample260703-b3yzsahy9w
- SHA256 c0e8dbc7ebe70e226c826f9c0881b2edf131a546db5524dfe99326b7adc01f55
- MD5 1eb82a065dee60173a540dd6a4eb7e92
- SHA1 bef4f4c3856014585b63733253bd9ee9864e5655
- SHA512 2da52e2eb34df8dd8fcf0e928988f439f2630ac2586a1540d7b5dc58fff691488c94e3693472313ddaa2a22c7487dc8116816e23055952a8ddfc56241747eb61
- SSDEEP 49152:Z3s/8PqvBauAg4zMyULKYocRKP/heZ6v9VYp:Zc/8ivBaZMya/ghC6vo
- TLSH T1D4B5BE12BB81C172E593063551BA4B7F4C3EAE200338C4D397A439A99E725D2673F7DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe 4904 2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_1eb82a065dee60173a540dd6a4eb7e92_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4904