Analysis
- max time kernel
98s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 01:54
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe
- Size 7.4MB
- Sample260720-cbrl3aew71
- SHA256 3d4159afb568580b79c723c7f6c6f48bf2f4f52d315f260289683f77154a5e8c
- MD5 0a616b330afc61c17f3958ef459f3ea5
- SHA1 c6312f05ed887ed93b8cb3590f21d30eee3876ba
- SHA512 b6449203f5231a32beb3d4152a86aa86b4482fe96e5eec16df31857261278a1673178ffc430f0338d32f91e02c46f1a67e85d092ae5395729ddc0a93b16dbdec
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjo:TeJ9ovUutoXhPVo
- TLSH T1F3765B19FAB48632E0B38175C9E69759E9727C515B3086CF1284B32D9E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3448-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ff-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3560-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e69b-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-292.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000212f2-575.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3448-1481-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3560-1501-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000227b2-1518.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002461e-1624.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001da34-2048.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3560 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3448 2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe 3560 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_0a616b330afc61c17f3958ef459f3ea5_amadey_coinminer_darkgate_elex_glassworm_hawkeye_luca-st.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 7.4MB
- SHA256 3d4159afb568580b79c723c7f6c6f48bf2f4f52d315f260289683f77154a5e8c
- MD5 0a616b330afc61c17f3958ef459f3ea5
- SHA1 c6312f05ed887ed93b8cb3590f21d30eee3876ba
- SHA512 b6449203f5231a32beb3d4152a86aa86b4482fe96e5eec16df31857261278a1673178ffc430f0338d32f91e02c46f1a67e85d092ae5395729ddc0a93b16dbdec
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjo:TeJ9ovUutoXhPVo
- TLSH T1F3765B19FAB48632E0B38175C9E69759E9727C515B3086CF1284B32D9E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 7.8MB
- SHA256 b4ba2a612516689d737f8bb57418a59526eeded6611f4e7d39bd7ec347915ada
- MD5 4250e49ea4225e9ebaf89966932c031d
- SHA1 5f8dfcb3c6bdd7c249be32579e8f4ff5674ca635
- SHA512 ce7fe0e5725ab7e738df4630996137202f0953e1f78ff255f400c83481b4720494b0b39a05b70806206417181961652d110490ba59998d29f5efb95aa8676d40
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjoKCqo:TeJ9ovUutoXhPVofqo
- TLSH T1FE865B19FAF48632E0B38175C9A69759EA727C511B3186CF1284B32D5E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 7.5MB
- SHA256 fe08934fd7626ae535bb444b52ed6afc7dd88e7f11fa90d8987fe9e71553ad5a
- MD5 65494c88498dd0b23cae0ec5afb01122
- SHA1 9157789afce98cae3f293dfefd9f6c6ca13ce661
- SHA512 5bffb9f38825bcd9cd7cd1ac0aaf6eb8f6f6a7284d103024fe3bc4b89c6bbb749162f061e25e8fe32fa1beaad4e13b8f7cd25700254eefcfc6e54f42b21ebdcf
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjoB:TeJ9ovUutoXhPVoB
- TLSH T186865C19FAB48632E0B38175C9E69759EA727C515B3086CF1284B32D5E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 7.9MB
- SHA256 8781591504a0d12951d81fff5a36b15cf362b55ec98d71fbed367b9bde395304
- MD5 d38115229b0ef1fcf1a5808df7e62a6c
- SHA1 3457dba500f442acf22c5f8c1bb69eecc9a983ce
- SHA512 98c57aa2df9e009da9c8e6ed81ae430ad5a38110c3bd224746d853f0bdd2b3fad5784b730e558506083dca1143e380e3f65262a7d7aab34898d0c72d9ff7ca59
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjo0jo:TeJ9ovUutoXhPVo+o
- TLSH T178865B19FAB48632E0B38175C9E6975EE9723C515B3086CB1285B32D5E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 7.4MB
- SHA256 ab230a4debfffd6908977e2bb0c846a35f0d90beb1f368f3a1c1dca0b7fc37b2
- MD5 cff3db99cac872674804bfda6338dcd2
- SHA1 d7ab4487bca7a03bb311815e7aebad2d6c5f26a4
- SHA512 6eff8232433bd85a6c0f67d628e2db4ba27c1468d96cbc853c16084a93bba958101523db55c787e31001f7b40d97143f5eb8eb12d608b667da25b0bca8bd0ce4
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjoa:TeJ9ovUutoXhPVoa
- TLSH T1D5765B19FAB48632E0B38175C9E69759E9727C515B3086CF1284B32D9E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 7.4MB
- SHA256 89086bb822cd4c91e93042e454c9c31c26c0a8351a3c7d6d7f18d034c80c53ee
- MD5 9a102ff1db95b68e28f47aa1af14eb0e
- SHA1 6eea05c4ea658a65639bcc0a925613364c086e9b
- SHA512 4afa0a7c86ab333ba790e33510332557c4b0713b9ef2b1c48d6de7e78d35a591071234c782033df618b0a16ec57bc3d8e67bc923ef87a50a407b1a77c16f5fbc
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjoJ:TeJ9ovUutoXhPVoJ
- TLSH T1FF765B19FAB48632E0B38175C9E69759E9727C515B3086CF1284B32D9E33FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 7.6MB
- SHA256 453dd9f35c9f7c14c184783e2b959724495163afbc89ef7649d157310fa54579
- MD5 75821794b145af9ff39c8d521655e5a0
- SHA1 da8da1111b3e08572343678927df04d861ebface
- SHA512 9deeeddd83dda3e2b886612a095a0fdd2a7c365376c7b0ae5cf31f9839199e8fd544e087431d3801eb184c6011d8c1c86f1451dfbde39955bc3b59f749036c8c
- SSDEEP 98304:TAEqUeh9Fchv7StiJdXN0B7+s1Cs1Cjos8FfkZcRjoMuX:TeJ9ovUutoXhPVoMA
- TLSH T171865B19FAB48632E0B38175C9E6975DEA727C514B3186CF1284B32D5E32FD18A36732
- MD5 SHA1 SHA512 SSDEEP TLSH