Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 02:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
- Size 3.6MB
- Sample260803-csv1tawgpg
- SHA256 5b9349a886ad54ea97f08a10c9431c2aa8566f8e565898c9123343ef3e86adcc
- MD5 a91373c89037e532683dcacc0b3246b8
- SHA1 e6dfdc49eb933a053745b1446fc73d50bc800071
- SHA512 15eb532dcaee30e8ba5176c8a410e10e3629f910261b98d0e3bcb03f2bd18b640e6f8620e940a3d195db9dc723f4c300793cbdeb3097521f2dbaf20972da4629
- SSDEEP 49152:lkXTiCRE+rKN8Kyf6l5QZuTtS0rQMYOQ+q8CEOSW5wpLXG1ZO9KFeM4:GG4rrKKglWsM0r1QndSRG1g0FeJ
- TLSH T1E106D011F7A2C032D49B02714DBA972E6538FD514B6546C7F7C83F2E5EB12C1AE3560A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
-
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\debugger 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\dkjkgbbld 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1908 3600 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3600 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe 3600 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3600 2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"1⤵
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3600 -s 5802⤵
- Program crash
PID:1908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3600 -ip 36001⤵PID:1020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\dkjkgbbld
- Size 88B
- SHA256 0914528b20c785dc239fc95f5e08df698d6054b43e64174e9c044fd860d833e5
- MD5 e8496aa5e5d786412880600314e89237
- SHA1 fa982042973cc0c81a6c8d015ef34180bac4f2a8
- SHA512 b538a938459acb028ab26134aca754c6874a5086458505606ec237b1a5bc5f3a1e6a9dea0238d3c618636b4b91f3c3372339b21c5d391853e23a59f451ba9163
- TLSH T12FB0016310F000901BE5F48C1163CF8ACFB700F239187287733605B80002D91CC40973
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\dkjkgbbld
- Size 104B
- SHA256 8422ed6bdd1f26288c7f87aede871216e58e24cac54de709d3d01035a394be76
- MD5 43300cd22314500aef64fc87b6595d73
- SHA1 77e97a9701f351bb4d2e935e5f1df2370e3cb8c6
- SHA512 6d1f92f0d6cfbf3cf901c6438b6e63122cdca25fdce29940fc154d9db7e964b4263fcc384c18c54af4d49b0cf665d2c3b8fe0484112312b1efee72352ccfb884
- TLSH T1C3B0096324F001902BE5E4881567CF8ACEA700F22A286287733605A800129A1C840973
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\dkjkgbbld
- Size 23B
- SHA256 0253d1e16e9f69e3874cfac0410336021b0135e0522a5bcc0ece2f38b3adf849
- MD5 148b7d64f038d6ceafa49fe355dfa946
- SHA1 fbd5faeb33766eccd641b4407f00ac2c8cf38f3e
- SHA512 d9b232403a56fd01918c77d8d85b98ca5c20fc7db35b32cfedd64f8ba880988220ba8f4ed6645f2b8b69bf7913c6977d3af62a90f5c41f3d1a2d0e62611dfa6e
- MD5 SHA1 SHA512