Overview

overview

10

Static

static

10

2026-08-02...ca.exe

windows10-2004-x64

9

2026-08-02...ca.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_97c07395165ab9122c73ad9c73861a37_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe
  • Size 25.9MB
  • Sample260802-j6he7sff22
  • SHA256 939e1c705c49b85b08d83b50cc7022412351051bfdfc0914fc5828036066b5d6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 8 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_97c07395165ab9122c73ad9c73861a37_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_97c07395165ab9122c73ad9c73861a37_amadey_coinminer_darkgate_elex_glassworm_hellokitty_luca.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:1952
  • C:\Program Files (x86)\Bose Updater\BOSEUPDATER.EXE
    "C:\Program Files (x86)\Bose Updater\BOSEUPDATER.EXE" /init
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3440

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AWS-CPP-SDK-S3.DLL
        • Path C:\Program Files (x86)\Bose Updater\AWS-CPP-SDK-S3.DLL
        • Size 2.4MB
        • SHA256 f21bcd19f480e3b39d550667e2f18bc15b6f4f46336baf3ccd587fb4c45212cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BOSEUPDATER.EXE
        • Path C:\Program Files (x86)\Bose Updater\BOSEUPDATER.EXE
        • Size 410KB
        • SHA256 22099dd1c18fe4f085ab84aa623fef45dfc84121f50da934835e4c9a7e9817df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Program Files (x86)\Bose Updater\MSVCP140.dll
        • Size 439KB
        • SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QWINDOWS.DLL
        • Path C:\Program Files (x86)\Bose Updater\PLATFORMS\QWINDOWS.DLL
        • Size 1.1MB
        • SHA256 ac3a36b775ac8b9cd1e3c3a7ac9dd31e0cc0a12b84d5942e97d77da20992d005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QT5XML.DLL
        • Path C:\Program Files (x86)\Bose Updater\QT5XML.DLL
        • Size 144KB
        • SHA256 c6cff6af4bab546ca2ac2d6e7fd999899a411d8a861c125e6bd36778817c0428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Program Files (x86)\Bose Updater\Qt5Core.dll
        • Size 4.9MB
        • SHA256 4714f75569aba7cebd6b13466527b190adc1999aef5c8f1f73cb2472282faf6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Program Files (x86)\Bose Updater\Qt5Gui.dll
        • Size 5.1MB
        • SHA256 78bca9c65600391ec4bb1fb0374169db13e7517ebd154a11d244248b25a7d939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Network.dll
        • Path C:\Program Files (x86)\Bose Updater\Qt5Network.dll
        • Size 1018KB
        • SHA256 e94054f7f5efebda73f2a075745b9391ff2ac1215b6bc55a6402bcc5aed880ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5SerialPort.dll
        • Path C:\Program Files (x86)\Bose Updater\Qt5SerialPort.dll
        • Size 64KB
        • SHA256 52c8bd89cd5b4543d5f393da9b7b04601cd4811d62a8eedef6db971a8fe2f298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Program Files (x86)\Bose Updater\Qt5Widgets.dll
        • Size 4.3MB
        • SHA256 91bb41088f847fb73641fa556eda6d67bacb67560b8abf6ea1f0c885390004f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.DLL
        • Path C:\Program Files (x86)\Bose Updater\VCRUNTIME140.DLL
        • Size 78KB
        • SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aws-cpp-sdk-core.dll
        • Path C:\Program Files (x86)\Bose Updater\aws-cpp-sdk-core.dll
        • Size 765KB
        • SHA256 8cd3ef7b0183fb255841c4dfda31413126006da28ce672beeaac21f421d2f154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1952-0-0x0000000000D80000-0x000000000275E000-memory.dmp
        Download

        memory/3440-23-0x0000000000890000-0x0000000000A3B000-memory.dmp
        Download

        memory/3440-48-0x0000000000890000-0x0000000000A3B000-memory.dmp
        Download