9e98da97a26bafa40088a2d188dfb68918f05eb018018508f808b6cc4d50fb7b

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a0383d22e30c8890c0b8ff918568a0ae_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 37.6MB
Sample260803-cty4vsap81
SHA256 9e98da97a26bafa40088a2d188dfb68918f05eb018018508f808b6cc4d50fb7b
MD5 a0383d22e30c8890c0b8ff918568a0ae
SHA1 86215644a26e9bbe621d485bd7f9eafb6875b743
SHA512 b8590ff9e4503b18bd0856c711ea2b31b1a1f7297f81e32f2147057cdfbc711cecf26c8837c1badeddbe2acec982156b7487898faf56b52aee16c623a897d74e
SSDEEP 786432:LvQsNZ7euOgH7O66SZV1bPVBzCs9g7hp33i:LQwXJCK9B/CtxS
TLSH
T17987C022F910C16EDAD101F1A9BCAF2D673C5F541F694BCB62C81D6DBA314C26637E22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2860	3420	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a0383d22e30c8890c0b8ff918568a0ae_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a0383d22e30c8890c0b8ff918568a0ae_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a0383d22e30c8890c0b8ff918568a0ae_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 260
  2⤵
  - Program crash
  PID:2860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3420 -ip 3420
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3420-0-0x0000000000400000-0x0000000002996000-memory.dmp

Download