e7ec78ac36e5badb9ff04dbd4cfddee3da22b1876c0ea5533db1a50324f41aba

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe
Size 7.7MB
Sample260728-gqlftack5s
SHA256 e7ec78ac36e5badb9ff04dbd4cfddee3da22b1876c0ea5533db1a50324f41aba
MD5 043c5750d1edf4bff5df4993bfcb8a3d
SHA1 619a289d0f21b1b2e12cf8456f63ec4a2f3f6e39
SHA512 75e1e23f0d9401c6769669810b961311a2e560999e9fbac16f28bfd92d48c8a55cbfea3a88ec45cac560688f8243bc090e778cea393da3d6fb558d374f166af5
SSDEEP 196608:5w0Ykbfk2JChWGxvUL44vGxxMxaCSBeuS4Ro1MKMOAIuUuSnmOz+8RkyqWCZzJEK:5whkbfk2J/GxG44uxixaCSBeuS4Ro1Mj
TLSH
T109866D22E140D731FDA30131AA6D7EB4421EAF641B25E1E3B78CBD4E15723D67A34A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe
2744	2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_043c5750d1edf4bff5df4993bfcb8a3d_amadey_coinminer_darkgate_elex_glassworm_maze_remcos_revil_smoke-loader_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.log

Path C:\Users\Admin\Documents\DVDFab\DVDFab13\Log\install.log
Size 5KB
SHA256 b4dccb43a6e98cd6cab5f00564f382a479fa9b37e22d37cb8abec99250341b92
MD5 ea56fe5de571cfddd52252f03de8b4f0
SHA1 982b3514ecfc4bc4b7faaab0f9a5a25d4320ff5c
SHA512 aed41027bf2d37a1fff61f8144cb0610d63a0b7e3b4ff82b0f27c1010e252a169e30405448925e1783a75cab5f702ee494bb293f39cc4732a84eabc1c350ecbf
SSDEEP 96:YiTI6iBDXWZR2zm1XG4usLYFsonE2uUFbiAzAgTyVSFZP0iW74JBP3qSAEQg:YiT+BDXWZR2y1VckK
TLSH
T171C1E5DB2EB3954452601D4096BC2B8BE2C3B90B711DA165F2B4160DD376533E8B8BCF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download