b23bb4cc30ab6723abc31b410cd01d52ebbab30f0665b01286195e16eff0d9e5

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe
Size 18.1MB
Sample260802-aecafaak3y
SHA256 b23bb4cc30ab6723abc31b410cd01d52ebbab30f0665b01286195e16eff0d9e5
MD5 a5c4179f02688068014e6356c639ee7e
SHA1 0fde9f1f6d9d4cd1cd2c415eb7d5ebee72b10917
SHA512 9531c2efb11e6cb7e9438b8f6def2d839ec3312614bc0b4b0dafb21b53b583f4eb75b8e2e3aca2ad3503bd2ec384a3ae90cf0b0fe4104a9be2a7d8516bfaab1e
SSDEEP 393216:kHR1hTSTG0J05lekUW3VP0m+DoOft5eYE2/a+8aLzov3qv0iq6JmYpleUBJ:kHRr2jJyDUWJuj1ffM3s0iqwmYpD
TLSH
T153171211BD824473E5630339569EB73E697EEA340B36D1D357C40A6D6C302E22B397AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1932	2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe
1932	2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_a5c4179f02688068014e6356c639ee7e_coinminer_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_revil.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.dll

Path C:\Users\Admin\AppData\Local\Temp\h72eqB73GL\7z.dll
Size 170KB
SHA256 b8521abda09ec17ddad36528c1bc50395dc8c5f7c11c026a5b3ff23110c54182
MD5 31cad6a3edd1c32981ad6b565cbeac94
SHA1 9338978c85a9423ee2a38cba027f79192d684f1b
SHA512 02e198b8ef192de55db35ae00a16a80b3309a9373a596c20d617b43dd7159a635bc303f371859e704375521a1242d02754807e2e9dfef63ffd06993b24c17d3d
SSDEEP 3072:xyljBP/VZjAISqyTFjoZAO1h7BTF1rJa//diUTTBXJxO8hlIhb0:xeBnVZ8w4toZAcLrJa/liSVHU
TLSH
T1CA04AF11B6A6C4F4D34F2132D96A3FB663B9D2848F6548C37BA0DE6E2E329C1D53520D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootmhr

Path C:\Users\Admin\AppData\Local\Temp\h72eqB73GL\tools\bootmhr
Size 388KB
SHA256 1f6b804b50a74cf0c511c7b90f4392ba038b1b4d521935d3bbdedbd6581276bb
MD5 9d48760c0f911ce98c046329378117e9
SHA1 0e3fbb49e35c7fe19cc045e23af0044f265595ca
SHA512 40e614b3de1f20aff8f2fbdde20b93a5d7f0931123ba678a7e3478d36e18b1f3939da8444296c43f26bcc606a8142a7cfd32d2627a78a50a8a102feb6594f2fd
SSDEEP 12288:ehBQF/ArM1eu8fh5TZUV4SJ8ez8Fq1WsH/sU8qQ:iQF71e1XZUVD8e4a/TdQ
TLSH
T13D8423840589EF2FC1090EF4558B951EE5B345C373A425CAFB62A42E8F49B26B35E70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zjz1425.tmp

Path C:\Users\Admin\AppData\Local\Temp\h72eqB73GL\zjz1425.tmp
Size 121KB
SHA256 31cd150ed9b53c24559350128ce959fe1ae24b422eb49b19521b20d6cd3730eb
MD5 fa34fdef5d2f7194adb98ac32459e25a
SHA1 946febafcb4876cc48971c57f15533d757dcd49d
SHA512 e204ddd1edede75d4f2a57b9dc973ae131e2bb862dd5a70ed5f51b95d2cab5da709929824d636600be7c2a9d02aa7725a467e5a23678d7b1d2c36e285d337d3a
SSDEEP 1536:bINRYE2graeJwvIMI4eChJGM3PJEItqjJrHtBJJIFtzmOVbnzXwqw8//wqwCBxTa:Be6caKGDcG+KG4UL+n3h3QNZ
TLSH
T17AC33A4ACF1C0BCA2E742C18112EF3CFDA0773D345A50159FEA96E1E4B539A4E39C5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-0-0x00000000003B0000-0x00000000015D6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads