48d778c374f37e96ca04c9d44faf93c00462db91b7bcfe5322f9433dafd7d793

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_c79fbe18164513e8c5bbe7bcda9c85f0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Size 14.9MB
Sample260707-2ldwdsft41
SHA256 48d778c374f37e96ca04c9d44faf93c00462db91b7bcfe5322f9433dafd7d793
MD5 c79fbe18164513e8c5bbe7bcda9c85f0
SHA1 a6541ffeb2f9e430e91c0579229c197eb191f181
SHA512 6b9aa23575d307f0808525d994b76bdc182a6f0749acf9bb4826fa2b7d81d75e2baa405edb8775174bc1098e36c9625a5ee96f4527b26bc70956729b3ed403d3
SSDEEP 196608:ZhUPNwnYBzzX5dzmHpn6F44IAWvcdcdQwdPdEd7:ZGNwszLjmHN6+JrvY
TLSH
T1D6F65A1177E660F9F1BB96358A769331D6767C234A31830F13ACD60A1E72A50AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/4468-0-0x0000000000400000-0x0000000000412000-memory.dmp	UPX
behavioral1/files/0x0008000000024568-6.dat	UPX
behavioral1/memory/4468-11-0x0000000000400000-0x0000000000412000-memory.dmp	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4468-0-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral1/files/0x0008000000024568-6.dat	upx
behavioral1/memory/4468-11-0x0000000000400000-0x0000000000412000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_c79fbe18164513e8c5bbe7bcda9c85f0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_c79fbe18164513e8c5bbe7bcda9c85f0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_c79fbe18164513e8c5bbe7bcda9c85f0_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 15.4MB
SHA256 7ccf6b000b255b6526d5e657fc2e09f40c79f56bc27fc806b283497d030a89d1
MD5 87a022eb9b31bd8684b1e760665abdcc
SHA1 d7c4e6cfba592b258994d156b0994de85f997b58
SHA512 8687d82815753d603ca89e7d376e592c18d68616145262d3e867af9905439f9ec39a22dc309df0de2a794c3ce6fa61ded77e1bc6d6967c049e599dc5dabb4b50
SSDEEP 196608:ZhUPNwnYBzzX5dzmHpn6F44IAWvcdcdQwdPdEde:ZGNwszLjmHN6+Jrv/
TLSH
T161F65A1177E660F9F1BB96358A769331D6767C234A31830F13ACD60A1E72A50AD39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4468-0-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/4468-11-0x0000000000400000-0x0000000000412000-memory.dmp