58ce2881686411ec17f1d6e0809c4bb7ae25925343badd7d8554e6b6f782e09a

Analysis

max time kernel
150s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
Size 17.8MB
Sample260714-2e2zmsg12t
SHA256 58ce2881686411ec17f1d6e0809c4bb7ae25925343badd7d8554e6b6f782e09a
MD5 3770fd8c3a720de01c8c4fe2c1b4b4dc
SHA1 df921f890f92a16f6f0e6521e656952fd4b32e85
SHA512 9bc83dcb8b7692fe467dda865242b5785f8dc439bfffe149be42016acfef5e05d0f51eeb3acdc3b7f6dece1e2e69dfee0b1187ebc3cda28b3512edf893810521
SSDEEP 393216:4p9FXLSWO94hwCyDGifwAbHVE4ieJ3hWO:4J764hwCwGCVE4ieJ33
TLSH
T14517BF831603D2A1FD292A7903D7D27065F867D974FAE11EEEA06C74DE389128E8570F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Detects executables packed with Themida 6 IoCs

resource	yara_rule
behavioral2/files/0x0006000000016b3f-7.dat	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2772-9-0x0000000000400000-0x0000000001DF4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2772-10-0x0000000000400000-0x0000000001DF4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2772-11-0x0000000000400000-0x0000000001DF4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2772-12-0x0000000000400000-0x0000000001DF4000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2772-27-0x0000000000400000-0x0000000001DF4000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dats.exe

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/2772-11-0x0000000000400000-0x0000000001DF4000-memory.dmp	UPX
behavioral2/memory/2772-12-0x0000000000400000-0x0000000001DF4000-memory.dmp	UPX
behavioral2/memory/2772-27-0x0000000000400000-0x0000000001DF4000-memory.dmp	UPX

Downloads MZ/PE file 2 IoCs

flow	pid	Process
3	4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
4	4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dats.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dats.exe

Deletes itself 1 IoCs

pid	Process
5480	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
2772	dats.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0006000000016b3f-7.dat	themida
behavioral2/memory/2772-9-0x0000000000400000-0x0000000001DF4000-memory.dmp	themida
behavioral2/memory/2772-10-0x0000000000400000-0x0000000001DF4000-memory.dmp	themida
behavioral2/memory/2772-11-0x0000000000400000-0x0000000001DF4000-memory.dmp	themida
behavioral2/memory/2772-12-0x0000000000400000-0x0000000001DF4000-memory.dmp	themida
behavioral2/memory/2772-27-0x0000000000400000-0x0000000001DF4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dats.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2772	dats.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dats.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	dats.exe
2772	dats.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
Token: SeDebugPrivilege	2772	dats.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
2772	dats.exe
2772	dats.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 5480	4220	2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe	88
PID 5480 wrote to memory of 2772	5480	wscript.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_3770fd8c3a720de01c8c4fe2c1b4b4dc_amadey_coinminer_elex_emotet_glassworm_icedid_smoke-loader.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Local\Temp\update.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Users\Admin\AppData\Local\Temp\dats.exe
    "C:\Users\Admin\AppData\Local\Temp\dats.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

set5.ini

Path C:\Users\Admin\AppData\Local\Temp\set\set_dungeons\set5.ini
Size 570B
SHA256 f025e696201565f17ae3f046b2e0225fc790cec24a4a42b4656c3cca4e96cbc5
MD5 1bc0662f457ff545478d86cb89c39d40
SHA1 1cc0c2cecfd85d492695564c93270d7245982265
SHA512 9dc89275745e325422f8111e4712cbb7575e89a62ae7283ec0a2da8161f57629ccab20169d3ce63105130ff3afa0f7cfba3212ea9eee6fa7da2512b656592d4b
TLSH
T113F02B3D0BA8BE5CD03471989C3A031835F51DA109162944931E4CFEBC12D807BC326D
MD5 SHA1 SHA512 TLSH

Submit Download

set5.ini

Path C:\Users\Admin\AppData\Local\Temp\set\set_field\set5.ini
Size 605B
SHA256 0883ea2c7864dd3b721e3954ef7ed008089a6bf952cce96bbeae65fd710387f6
MD5 07414e276efaa687fe87d76424353fc0
SHA1 fe56b827f87127ae93dd2e0f162333471b8bfc92
SHA512 bf7f37be4beee5f1c3b602757bee7668f083e88a55ebfa7d3aa8c63ec66ec67a2523e544e08174185b384a13a6a4c3682adf18a7c65e12b398402cb23db0d586
TLSH
T1D4F0222C0BA8BD9CD034B1A59C7A030935F92DA10E122980E34E58FDBC22E806AC719E
MD5 SHA1 SHA512 TLSH

Submit Download

update.tmp

Path C:\Users\Admin\AppData\Local\Temp\update.tmp
Size 16.3MB
SHA256 65897787e98320e9992fc6c93d0f4db528273f6c3c5ec84411f104f2d7548569
MD5 9a3d428afd64d837529a254b8201e2b3
SHA1 12ed5b052fe47412d58792514306225e0bdbc54a
SHA512 50a4fef6f0eea2619c6f5fd08ce9ce3a231afcb20a0140b9896bef2e35baf8598cf615cd606e6a6de8acfe6feb4ad6cedb47fdef28c8e09d2fd18deae56f88e4
SSDEEP 393216:Hf/5yj7rtLhqebWGEuz1hY9OwTLehSEp:/Y3rVhgGbz1IyNp
TLSH
T1390723223EF5D08DC4A40BB7A53EC1454FEA8974C5CC88463DD0B95BA797A9BAD36330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.vbs

Path C:\Users\Admin\AppData\Local\Temp\update.vbs
Size 625B
SHA256 0f1878aa4bb2e5bb5099f68305a43681be3888d60940b17666e843461b324d48
MD5 9ec74d3900fc7c813c7b545615e3fd84
SHA1 1f4d40ace35971fc19692d4b3e1ef01fb1eb507f
SHA512 7b3ec59418ae2fab235663286c8d475dbee7dc0ffa4298ca6392b5875842e7846bef2ec3078b8372d58b00c7644684c6cf799411cc8f4eb0bb54aabf03949a51
TLSH
T1FFF0780AC7DFCA2F0098D85744F3A54CC1A008183F463B254B60DC4C378292AF9CB78A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2772-9-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/2772-10-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/2772-11-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/2772-12-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/2772-27-0x0000000000400000-0x0000000001DF4000-memory.dmp

Download

memory/4220-0-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Download

memory/4220-1-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Download

memory/4220-2-0x0000000001CA0000-0x0000000001CA1000-memory.dmp

Download