5b9349a886ad54ea97f08a10c9431c2aa8566f8e565898c9123343ef3e86adcc

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Size 3.6MB
Sample260803-csv1tawgpg
SHA256 5b9349a886ad54ea97f08a10c9431c2aa8566f8e565898c9123343ef3e86adcc
MD5 a91373c89037e532683dcacc0b3246b8
SHA1 e6dfdc49eb933a053745b1446fc73d50bc800071
SHA512 15eb532dcaee30e8ba5176c8a410e10e3629f910261b98d0e3bcb03f2bd18b640e6f8620e940a3d195db9dc723f4c300793cbdeb3097521f2dbaf20972da4629
SSDEEP 49152:lkXTiCRE+rKN8Kyf6l5QZuTtS0rQMYOQ+q8CEOSW5wpLXG1ZO9KFeM4:GG4rrKKglWsM0r1QndSRG1g0FeJ
TLSH
T1E106D011F7A2C032D49B02714DBA972E6538FD514B6546C7F7C83F2E5EB12C1AE3560A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Indicator Removal: Clear Persistence 1 TTPs 53 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBoxVM.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanpst.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows10universal.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cnfnot32.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scanost.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe\debugger	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dkjkgbbld	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4768	4364	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4364	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
4364	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a91373c89037e532683dcacc0b3246b8_amadey_coinminer_darkgate_elex_glassworm_kwampirs_remcos_smoke-loader_stop.exe"
1⤵
- Indicator Removal: Clear Persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 620
  2⤵
  - Program crash
  PID:4768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4364 -ip 4364
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 104B
SHA256 a2a2f1497938394429e673d2514ed884fb42742885c13e9b206141a5fa925f73
MD5 bcf69c6414bd15afc12812ef7f14633b
SHA1 0d87bf2fbd7da97453bffaa13df5d0b1a6b071fa
SHA512 88b209ec0469b008229df183007cfef50b1359b813c249ba688040daa4a5b7c3a6830ccd8da056b0e8d7fadac0d29b19b473897c9f96faf59b953b0952a1c6f5
TLSH
T17DB0097204F001942AD5F4881506CFCAEEA700F22AAC6687733606B880108A1C840971
MD5 SHA1 SHA512 TLSH

Submit Download

dkjkgbbld

Path C:\Windows\dkjkgbbld
Size 70B
SHA256 bfcbca8cbba714260c72a70ecd4094c27f0c767bb4f4cd707bd0b9331120eef8
MD5 56c075ed4a19b04b7a148234fd664e12
SHA1 80cdeb72e0fbf3e2a38fd99aeae8521044cabb32
SHA512 08b5ebf3ecce61bc9838feb6611a78f5baaebf954f164c7153b53b6a0aca868efda381f8c2abdcd954663c9cceb8c832badd399c6469f1de058d9538a122507c
TLSH
T1C0A0017200F000500AD5A0481002CBCAAEA700F2258C6687733104B40000841C840971
MD5 SHA1 SHA512 TLSH

Submit Download