Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 09:42
Behavioral task
behavioral1
Sample
2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe
- Size 1024KB
- Sample260714-lppjash19p
- SHA256 315058bb22d6fde48f46e07b779ef0e0f3fce444df7561ae08b13fd28095521e
- MD5 e6403fe7f0eda25c5eb20635cfbed5ae
- SHA1 96d5d56dca5d2e1097f694ce306865ced0c1ffc4
- SHA512 8de144a885faf6a9e7158f853dd875971e54ffefb6cf4b87f1d13f44d90bd1fa94590f054eeef435ee9074e1a75128fa7b0c506f850e7c0ab6e8bf8811d93dcc
- SSDEEP 24576:sjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:sTGkQyhuTtS0rQi
- TLSH T15F25AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 10 IoCs
resource yara_rule behavioral2/memory/4080-0-0x0000000000540000-0x00000000005C9000-memory.dmp UPX behavioral2/files/0x000600000001b85f-2.dat UPX behavioral2/memory/3180-3-0x0000000000BB0000-0x0000000000C39000-memory.dmp UPX behavioral2/memory/4080-18-0x0000000000540000-0x00000000005C9000-memory.dmp UPX behavioral2/memory/3180-20-0x0000000000BB0000-0x0000000000C39000-memory.dmp UPX behavioral2/memory/3180-24-0x0000000000BB0000-0x0000000000C39000-memory.dmp UPX behavioral2/memory/4080-39-0x0000000000540000-0x00000000005C9000-memory.dmp UPX behavioral2/memory/3180-40-0x0000000000BB0000-0x0000000000C39000-memory.dmp UPX behavioral2/memory/4080-45-0x0000000000540000-0x00000000005C9000-memory.dmp UPX behavioral2/memory/4080-52-0x0000000000540000-0x00000000005C9000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3180 c1a2dc30 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 2 223.5.5.5 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 35 114.114.114.114 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 36 223.5.5.5 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 70 114.114.114.114 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 71 223.5.5.5 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1a2dc30 File created C:\Windows\SysWOW64\c1a2dc30 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache c1a2dc30 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content c1a2dc30 -
resource yara_rule behavioral2/memory/4080-0-0x0000000000540000-0x00000000005C9000-memory.dmp upx behavioral2/files/0x000600000001b85f-2.dat upx behavioral2/memory/3180-3-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/4080-18-0x0000000000540000-0x00000000005C9000-memory.dmp upx behavioral2/memory/3180-20-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/3180-24-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/4080-39-0x0000000000540000-0x00000000005C9000-memory.dmp upx behavioral2/memory/3180-40-0x0000000000BB0000-0x0000000000C39000-memory.dmp upx behavioral2/memory/4080-45-0x0000000000540000-0x00000000005C9000-memory.dmp upx behavioral2/memory/4080-52-0x0000000000540000-0x00000000005C9000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\367158 c1a2dc30 File opened for modification C:\Windows\45d9e0 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1a2dc30 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" c1a2dc30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" c1a2dc30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" c1a2dc30 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" c1a2dc30 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing c1a2dc30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix c1a2dc30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" c1a2dc30 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ c1a2dc30 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" c1a2dc30 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 3180 c1a2dc30 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Token: SeTcbPrivilege 4080 2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe Token: SeDebugPrivilege 3180 c1a2dc30 Token: SeTcbPrivilege 3180 c1a2dc30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e6403fe7f0eda25c5eb20635cfbed5ae_coinminer_elex_glassworm_kwampirs_mafia.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4080
-
C:\Windows\Syswow64\c1a2dc30C:\Windows\Syswow64\c1a2dc301⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\c1a2dc30
- Size 1024KB
- SHA256 2455dee1678c370f176bcac0f25b3af688c8d8e8cf99e3731280547974145339
- MD5 97a9a89c1c67abc01db3e5698d516c27
- SHA1 7670381e499ed9b127c1d2cf44f2c64e0788d87b
- SHA512 b0f94023e9372c84c19414b61598621a48dc667879aa3b460a122b51b801a3788f31bc0165faf049653756adae3999cab0c5b83c65da86ac011014d597acdf46
- SSDEEP 24576:qjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:qTGkQyhuTtS0rQi
- TLSH T11725AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH