909e84888bacd90cc8d213bab6c087c3976321010fea075b0485161ba85bc7a5

Analysis

max time kernel
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Size 78.3MB
Sample260804-glsdkadh74
SHA256 909e84888bacd90cc8d213bab6c087c3976321010fea075b0485161ba85bc7a5
MD5 ad02be78e7c765a1152c03c72e16d039
SHA1 056ee8747c056a57b4d709cb6590100b7c8bb6be
SHA512 4ad8d7225b726cd2fea4bf75267ab02ef5555c5ba8669f604891fd4bb70f096220a38223fcba975fade173d96c2f1ffbf7497c34762e0408c506b55694f2364e
SSDEEP 1572864:a111C1113111C1113111C111G111C1113111C1113111C111w9:u
TLSH
T10B08AF09FD8744F1D92B51B00DDBE3BF8A707A25C4228EBAFB4DCB1B7923B615418256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
1004	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
1816	svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCBCABCCACBACCAAABCACAAABBBBBACCCCBCCABCACCACCAAAACBBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe"	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACCCABAAACCCCCCCBCABCCCAAACCAACBBACACCCBCBACACCBACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe"	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5672	sc.exe
2384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5248	cmd.exe
3264	cmd.exe
3136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3528	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
1816	svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe
1816	svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
Token: SeDebugPrivilege	3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
Token: SeDebugPrivilege	1816	svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 5248	3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	91
PID 5248 wrote to memory of 3528	5248	cmd.exe	93
PID 3820 wrote to memory of 3264	3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	94
PID 3264 wrote to memory of 5672	3264	cmd.exe	96
PID 3312 wrote to memory of 5912	3312	svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe	97
PID 3820 wrote to memory of 3136	3820	2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe	98
PID 3136 wrote to memory of 2384	3136	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_ad02be78e7c765a1152c03c72e16d039_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hawkey.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCCCBCBBBAACCBCABABBBABBBCBCCCBCAAAACCACBBCCBCCCCBCCABBABABCCABAAAABBAACAACACCCBBCAABCBCAACCBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCCCBCBBBAACCBCABABBBABBBCBCCCBCAAAACCACBBCCBCCCCBCCABBABABCCABAAAABBAACAACACCCBBCAABCBCAACCBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe" start= auto displayName= "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe" start= auto displayName= "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBAAABCCCCAAABBACBCCCBBBAACBBBAACCCCBABCACCACABCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCCABCCCBBBBAACBAABCCBBCBCBBCCACCABBCACCCACBCCBACAA.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABACACCBABABCBBBBCCAACCBBACAABBCACCABBCBABAABABBAAAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ff788941e395c2474ed6e74bfd6c10cd9d9b65b1a4b04beeecc83ecfbbec206
MD5 281b1cb53fb4971771aa41b48cdb9e0d
SHA1 bad7bab822d4eee12168d1d614cb92efe9be66b5
SHA512 2273681eaee14b6011ea3b24346e6b0306b9ec60f3659d4d7cd6d95b9ef620afefcf96f425c38b43ea4dd709c776d5ee47491a38f797e92cccbcdf46fb8fe1eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8b831be43bb45ec8326306efbac7ada3660cd9f4a7aa37bbf505c45dcba084e2
MD5 3bbbd2b51cf3f836f446b0eb73569322
SHA1 df39cb2df13871ada01f451a6b998ccb846cd2eb
SHA512 34702687f9b7908134f1e4245480ad53fe750d6f0d7e4725284233970a40d0fb231b9e9d7f36ecdd03ba8031a69a8a59ebe45838438cd26a5740a6dba619e87c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fc37db00e69a24a7b13bf8e69ab6de676659beec8d34cd59418cff4204ee962e
MD5 23a2eda5ac302be301897cf205934608
SHA1 7b6f105399d7ad1414b4b37222c06f3996d26271
SHA512 67dac0060eb21325d16508cd8b5cb7d411ee4576d96c97429ebf890399dbdf5607e0c4aa29bb5b1022cc600e1accdad83da32f95f4eaec5b7cbfea37433799e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e593bf896cb0152803cb6568d7d4077047aff0922173de3f460b10eedea780af
MD5 72f1fa2760f4244eec76a89d1aaab0e2
SHA1 3d3e54952ffc9a484afcb5819a8644fe5e2c6907
SHA512 06d82aac69e938808dde4a62f7d0e2ffd2072161d32caf11ca40c18cab88b1600c01f935a549ed500a5b4c8274774342e214fcc605a2365b5c4235f06d8adb65
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7525e4a0731e6b8d5f8e6825cf797da865d39f35d148eb04051c85e81d449737
MD5 936d86c7267541ed6ec02ac34cc05d10
SHA1 01f7d3ccf85cd205f5cc8b85f2fcbc6696c81772
SHA512 33392e3b19771f298e115c558b23c277405fec3d3eb99d5fe2e9e126b157059244aec4f62dca235f2236c0d8edc7cf6d52fd07debf6a002cd08435c5983a7c74
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7864fbd635f2dfb826c51b80108899458ec808ee28d5997150b0a9c16f0d2aeb
MD5 2948195be5940c7c701499278a98344a
SHA1 08526627963080487b856984d47f562238923a88
SHA512 e3c8a3587a9c909d03a7838703db5e0a3941a8eead19cfb10a70a7a0a0cb05bbb0faa3f94d8cf576dfb9803c40245ab59f1ab13ad028221f448f9dc9f8598dbf
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 558af3d7b4ea06cabe9edbdc4fd7e916ca51c61f3f53686f08acf5b3741092e4
MD5 e001b783a6ccc653dd676004810ea9bf
SHA1 08e459a965d3443f3bfc25e3d8e110801aa021d4
SHA512 37150a3c02e00ce48fbe6282ac41443705d23f8714fe78b6b4ca3873bb8131a1923b1a216c605c772bbccf2a42fbf219b30119535b288564aaeaf71841d8d95f
TLSH
T152112B31D0EAD823E87264CFD925DA830CE5729E9C5C7E80535582187FD8C328F1E4EA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-66-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/1816-81-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/3312-36-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3312-23-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3820-0-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/3820-7-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download