Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 16:17
Behavioral task
behavioral1
Sample
2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
- Size 3.3MB
- Sample260728-tre2ms1why
- SHA256 fe1498dd3d1b813ec5e0841c15ef61a293b272c751b9e4b11a5065efee12290d
- MD5 022f891322b6b3ebcfd8907a42dfe3b7
- SHA1 10fa6b6de3c32b0a288cf2902176e162ed21ac11
- SHA512 04c9789e613a8cf947c41745c95632d1efa969513abf9244ff15d00e00f447c673d3672b9c80d8c77d525c195c168b2f9cf0e3b0afbdeda4959aa46e40cdfbdd
- SSDEEP 49152:0HHKX2WQY5QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS90:0nK7LWsM0r1QnRK4xKH9e
- TLSH T18CF59F12F350C035C4AB463589BA47AE9679BD210B2157CBA7C47BAE1FB33C16E3570A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/memory/3804-0-0x0000000000640000-0x00000000006CC000-memory.dmp UPX behavioral1/files/0x000a0000000004e9-2.dat UPX behavioral1/memory/3748-3-0x0000000000970000-0x00000000009FC000-memory.dmp UPX behavioral1/memory/3804-12-0x0000000000640000-0x00000000006CC000-memory.dmp UPX behavioral1/memory/3748-13-0x0000000000970000-0x00000000009FC000-memory.dmp UPX behavioral1/memory/3748-30-0x0000000000970000-0x00000000009FC000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 3748 5d9be5f0 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 26 223.5.5.5 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 3 114.114.114.114 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 4 223.5.5.5 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Destination IP 23 114.114.114.114 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d9be5f0 File created C:\Windows\SysWOW64\5d9be5f0 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 5d9be5f0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 5d9be5f0 -
resource yara_rule behavioral1/memory/3804-0-0x0000000000640000-0x00000000006CC000-memory.dmp upx behavioral1/files/0x000a0000000004e9-2.dat upx behavioral1/memory/3748-3-0x0000000000970000-0x00000000009FC000-memory.dmp upx behavioral1/memory/3804-12-0x0000000000640000-0x00000000006CC000-memory.dmp upx behavioral1/memory/3748-13-0x0000000000970000-0x00000000009FC000-memory.dmp upx behavioral1/memory/3748-30-0x0000000000970000-0x00000000009FC000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\402ac8 5d9be5f0 File opened for modification C:\Windows\412038 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d9be5f0 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 5d9be5f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 5d9be5f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 5d9be5f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 5d9be5f0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 5d9be5f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 5d9be5f0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 5d9be5f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 5d9be5f0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 5d9be5f0 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3748 5d9be5f0 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Token: SeTcbPrivilege 3804 2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Token: SeDebugPrivilege 3748 5d9be5f0 Token: SeTcbPrivilege 3748 5d9be5f0
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_022f891322b6b3ebcfd8907a42dfe3b7_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
C:\Windows\Syswow64\5d9be5f0C:\Windows\Syswow64\5d9be5f01⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\402ac8
- Size 506B
- SHA256 0d529e96d02924c4afc7f727f4dbaa3f1d722b86cacbeef111101479f340a855
- MD5 d201eab8310e54ec74bb58622c3fd5db
- SHA1 33bf5368edd8b3c3157a136b3812cda20b983849
- SHA512 b313879802b0d7a48a838c20a511384e49cc521f807756447ac98745fc45ba65578ed5ad720ddf6e6440bbba90ef48bb69ba9e6d300cb6392c920b35f7ea1740
- TLSH T139F0C97A942273AA4EEE2D794A07D8291005712FC01B23E26ACDF404C5663826D83400
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\5d9be5f0
- Size 3.3MB
- SHA256 e0fff527b5cccac628581f328be8906a8a8ed5f22a5ee4712661ded55f7357b0
- MD5 73535c410d4b543a3e5694041cedb72d
- SHA1 9bdf85e69804e9c6ddadbc54c082c2df4ae946ba
- SHA512 98ff2f9b702d22707fdeba1af0dd655f9792fe00841d7bc9cd5915c9f612dc3e621d1a0da3a5a9f7f0aaacfd2e24080170a978edcf6ee9b6368a7c18ef6b0185
- SSDEEP 49152:CHHKX2WQY5QZuTtS0rQMYOQ+q8CEOTG4QwTGHQS90:CnK7LWsM0r1QnRK4xKH9e
- TLSH T109F59E12F350C035C4AB463589BA47AE9679BD210B2157CBA7C47BAE1EB33C16E3570A
- MD5 SHA1 SHA512 SSDEEP TLSH