2a6ada77a04b2cb08d04610faa9a5ecdf08eb34a177ec06c6c2bb9ab5273fcba

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 13.8MB
Sample260714-e8p6lsgw7y
SHA256 2a6ada77a04b2cb08d04610faa9a5ecdf08eb34a177ec06c6c2bb9ab5273fcba
MD5 095af98a7b60ad094f9b806e0fc9202d
SHA1 27ff320b90c0089c1a2472d03344367e1db7f43e
SHA512 fedde08341841d2e0e7279f3798151ba93f2a6456c1f78b362f9973fac02e458d39c45a23829fb025c0dfacaf82723ebd8190322e92a1bf3a865885e64155ea9
SSDEEP 98304:ABXT+t/urXlO5xLhSwnIUjQsdKoDaGuFR2YulEMgAABvKb67slKnfN8kr5vMGnHL:uCuzgbSHyNDaVFRJtjCb67mKnnMD
TLSH
T140E6AF03FBA349F2DC830070557FBB7B897E8A244B2446D397A05D5EA8722D1163B79E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4680	2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4680	2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
4680	2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_095af98a7b60ad094f9b806e0fc9202d_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

globals.ini

Path C:\Users\Admin\AppData\Roaming\System-G\globals.ini
Size 26B
SHA256 e3726cdbbc35ff115ea29b49e8de1a9d1c8639cadcd9aadb3c1bfe7a37b2b80f
MD5 e132d9298f583ffc64d9b1d49854886a
SHA1 72b54b65fd5e04aafd8c21939ff19523ee188f55
SHA512 b6ab6726c97e01ff7560ff57cd53bd713c812ad3318a22afa0733e4cb9fd277bc3fb54040cf8b260a1ade361d27251bad9e7cadfa2f0fd305d3f4033875df16f
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\System-G\settings.ini
Size 144B
SHA256 15bcfff27846412c206acbc9de771e7d870870a47ca7589ed0a94bce9734ea36
MD5 08b14bd8d0f13e0fdd41c584a18f761e
SHA1 08d864c414c4d58c20a3cf12c21f69d03ae09c41
SHA512 d6e3b21051367f20f6bbacfb0da028927f7d80adefd54855e348fec33315268df9a6903468d495f91dde7ca3ef1fdf71aa51b718302d03711d97a74f96274b6a
TLSH
T18FC048DA215423B0E322003413C1E4E0BC92172B8002FE4530B1BBAD98C4B0015F6D40
MD5 SHA1 SHA512 TLSH