Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 04:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
- Size 3.0MB
- Sample260716-e8hrjagw8t
- SHA256 1ec9fb0d7948cc82ff73cde2c2ba7f3d4e02448e129ec4da8b806368673e5d13
- MD5 053f0050b8024d2096d697a56bacb4c1
- SHA1 310d3769a071b3138aeefd3642d601457145154a
- SHA512 d2c37baf228af2dfc53f562bf2269f8aecfe6df46ae87ba96be5b74f1af646a0f3a3a64aa586acf9ce9e04ed47394d865ac9eef7bbaf639f25e3ec57189bd964
- SSDEEP 49152:pHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:pnKdBWsM0r1Qn1K4XKH40Feq
- TLSH T182E59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x000a000000011390-2.dat UPX - Executes dropped EXE 1 IoCs
pid Process 4588 16278820 - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 35 114.114.114.114 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 36 223.5.5.5 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 40 114.114.114.114 4588 16278820 Destination IP 41 223.5.5.5 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 1 114.114.114.114 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 2 223.5.5.5 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 16278820 File created C:\Windows\SysWOW64\16278820 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 16278820 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 16278820 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\4e8c58 16278820 File opened for modification C:\Windows\61edb0 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 16278820 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 16278820 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 16278820 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 16278820 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 16278820 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 16278820 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 16278820 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 16278820 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 16278820 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 16278820 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4588 16278820 4588 16278820 4588 16278820 4588 16278820 4588 16278820 4588 16278820 4588 16278820 4588 16278820 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Token: SeTcbPrivilege 5720 2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Token: SeDebugPrivilege 4588 16278820 Token: SeTcbPrivilege 4588 16278820
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_053f0050b8024d2096d697a56bacb4c1_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5720
-
C:\Windows\Syswow64\16278820C:\Windows\Syswow64\162788201⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\16278820
- Size 3.0MB
- SHA256 bf3f9d08aea1769812cd3209f6c37e0c1a8a3b9a76b3bdd0c4b2257600ce4c47
- MD5 5dbe2d7c27ddad9cd3b276704a75c91e
- SHA1 1e5c1b1670d8e7547ddec6df9f4234274a86b88f
- SHA512 7abc2ca3fd3ce140919dbfc3ad5fe1952671d50a90588c26d747aafdaec5923ed59213856fdcb7ec661ff96b1cb91a71b3cba6f38f83789ff5edb1b7881a5ef3
- SSDEEP 49152:tHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:tnKdBWsM0r1Qn1K4XKH40Feq
- TLSH T1FCE59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
- MD5 SHA1 SHA512 SSDEEP TLSH