49dd658015e39ab8f6b80212139a4bbcbcd055b2d06c52e90ea365542beab622

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_000bc84a397a6a188eb48936fd2b82b7_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
Size 4.5MB
Sample260714-ca2ewacv5l
SHA256 49dd658015e39ab8f6b80212139a4bbcbcd055b2d06c52e90ea365542beab622
MD5 000bc84a397a6a188eb48936fd2b82b7
SHA1 d96730db9496265557d480c9cf9abf4f789311ef
SHA512 0a59bd270eda851efd83463c757cda988943ba846152bca509726c38b4684b943426d41592fe189503149120fee5974cf9bfd59c151c67ba08ad70ef30b7dd5a
SSDEEP 98304:2tXYUzOYKGm4R3NXh/eozNpacKT/CM4vyRE7Dm1Yzz:2HzhKkzX0ZvT/6z
TLSH
T14926AE21B7459172EA8202715939E7BE4A3DBD352F6580C7E3D03EAE59313D33B3924A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_000bc84a397a6a188eb48936fd2b82b7_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_000bc84a397a6a188eb48936fd2b82b7_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_000bc84a397a6a188eb48936fd2b82b7_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

acc.dat

Path C:\Users\Admin\AppData\LocalLow\SogouPY.users\acc.dat
Size 80B
SHA256 483e12ba1dded31592042ebbd1b5ad4962413a490d24090ea659b4d07462dd51
MD5 100e4235b4d4c958010abc2a49b1545b
SHA1 32da45f68057e9446f784570a2102ae33005490a
SHA512 8b8c12211405cd43c9c2a39419da53ec29547b2eeaf9a304b8129764d3fc9e133b90e7ae048495bdda8cc5f4758cec861fdcf9a258e27c26f8c6ae9eaf6f1f7d
TLSH
T127A012C35139108070858DD6C5736E21651D563E30081A440215424049B065008D0032
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4844-0-0x0000000000400000-0x00000000008A3000-memory.dmp

Download

memory/4844-11-0x0000000000400000-0x00000000008A3000-memory.dmp