Analysis
- max time kernel
74s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 18:25
General
- Target 2026-07-04_79f9ba3a0c18be32c7ba5c5bd506df75_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe
- Size 3.0MB
- Sample260704-w2xesafx3n
- SHA256 bb733e6df7f27d81d9a488faee4117c6ecd54b78dcf364b011700e9187bb2038
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_79f9ba3a0c18be32c7ba5c5bd506df75_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_79f9ba3a0c18be32c7ba5c5bd506df75_coinminer_darkgate_elex_glassworm_luca-stealer_medusaloc.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
memory/2740-171-0x0000020600940000-0x0000020600BFC000-memory.dmp
memory/3032-20-0x00000235001E0000-0x00000235002E0000-memory.dmp
memory/3032-44-0x00000235143D0000-0x00000235143F0000-memory.dmp
memory/3032-30-0x0000023504080000-0x00000235040A0000-memory.dmp
memory/3032-27-0x0000023503EE0000-0x0000023503F00000-memory.dmp
memory/3032-28-0x00000235140E0000-0x00000235141E0000-memory.dmp
memory/3032-170-0x0000023500B40000-0x0000023500D23000-memory.dmp