7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:32

Target
2026-07-18_b77eceff4cc735edfc031cf3cc6c0d14_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Size 9.9MB
Sample260718-mla26sbx8x
SHA256 7cbd95119ddc91330560f1bbdb3921230b6ba041022df4f3a88bfff062ba63a7
MD5 b77eceff4cc735edfc031cf3cc6c0d14
SHA1 a5ef1785fd415ed7bd595050e13f1c134aae321d
SHA512 daacc90cb1507b8c3263ea583c49adfeb6c80353d8a48c8222bb00ff475096b5afdb3d74bddada9c04347edab579472f9347762fbb39e0613ba48d477cc97f9f
SSDEEP 196608:233kmOY1STQDrCzZkRuAGpOpfwNbWBhvd/wrJawaST:2HkmOYwc/CjAaOdw1WBZd2a5I
TLSH
T1E8A61221B6B2C072D55652308B3DAFB645ECA734472091C7B3C45E2E6E316D3E236B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/5052-0-0x0000000000F50000-0x000000000193A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
5388	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_b77eceff4cc735edfc031cf3cc6c0d14_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 5388	5052	2026-07-18_b77eceff4cc735edfc031cf3cc6c0d14_amadey_coinminer_darkgate_elex_glassworm_graphican_luca-.exe	89