0cec9f0f4ad8c5d0d5a7324fc08b2fd84dcaeb24e0d134662f0ff8afdcfd1e3e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
Size 17.5MB
Sample260707-qqbfaaay7x
SHA256 0cec9f0f4ad8c5d0d5a7324fc08b2fd84dcaeb24e0d134662f0ff8afdcfd1e3e
MD5 214189af4fd4df9b80dbc2b291d3a08a
SHA1 9a98712a3c155112d400e80f2194c6c36bbca4e1
SHA512 e2fde119c6d34b6c76af25e2b1f26e56aa653f880fe083eeb300fb7204a4e36a7b98f79f0123b3984fadde79c74b3e0f1fd5caf3f9860c20bbafc67e6adcf3e9
SSDEEP 393216:qri6FTcNGYkPosqXhSPdHx7LqJsv6tWKFdu9C0s:Ci6xcZkPosqmbHs
TLSH
T11E07CFC2F68380F2E9961170517BA73F5B30B9054B1596E3A39C3ED9E9312D13A3B68D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3004	2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_214189af4fd4df9b80dbc2b291d3a08a_amadey_blankgrabber_coinminer_darkgate_elex_glassworm_lu.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x0000000006090000-0x00000000060A0000-memory.dmp

Download

memory/3004-1-0x0000000006090000-0x00000000060A0000-memory.dmp