224dada9eed1544c2f9e6f65fa9a130133e38cb854f2d838237e50d0cb45442b

General

Target
2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Size 4.8MB
Sample260804-mgf3mattay
SHA256 224dada9eed1544c2f9e6f65fa9a130133e38cb854f2d838237e50d0cb45442b
MD5 a42a6de3eeb82e2449dd5438871b7f88
SHA1 b0e5b943a3728c56ca6db3cf21d59da364f2cc92
SHA512 269ef554738d4ca460ca805d47d806857c8f2728c083001ea4b239ac1f7a2e5a8656f77e4417331182e3c34aea60a8c3d6c0deed7aba06856ccd8f8500c35923
SSDEEP 49152:wHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:wnKdmWsM0r1QnIK4PKHd0FeS///x
TLSH
T1F2367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244af-2.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
5052	eb1a7f51

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	6	223.5.5.5	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	31	114.114.114.114	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	32	223.5.5.5	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	eb1a7f51
File created	C:\Windows\SysWOW64\eb1a7f51	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	eb1a7f51
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	eb1a7f51

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\567df8	eb1a7f51
File opened for modification	C:\Windows\37e180	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb1a7f51

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	eb1a7f51
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	eb1a7f51
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eb1a7f51
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	eb1a7f51
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	eb1a7f51
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	eb1a7f51
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	eb1a7f51
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	eb1a7f51
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eb1a7f51

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
5052	eb1a7f51
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeTcbPrivilege	3264	2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeDebugPrivilege	5052	eb1a7f51
Token: SeTcbPrivilege	5052	eb1a7f51

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a42a6de3eeb82e2449dd5438871b7f88_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264

C:\Windows\Syswow64\eb1a7f51
C:\Windows\Syswow64\eb1a7f51
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eb1a7f51

Path C:\Windows\SysWOW64\eb1a7f51
Size 4.8MB
SHA256 3fd748b227939beff8ca3478fb16a33eaa38bdad75cc98d6742220f643d9888c
MD5 2bb08aa6fee9e3972b76be339bda5619
SHA1 551400d86060c08b79c04bc811b125aba8e451ca
SHA512 c43c89b10ca63be3884114776f3bcb67fb7fb8678dea18c91cea00fb78d906a32d6459717ee372086b3a7d4b5a2a746da841bb1d9dbf1aa92f20268660292c57
SSDEEP 49152:WHHKO29Ql5QZuTtS0rQMYOQ+q8CEPfTG4Q2TGHQe9KFeMx///x:WnKdmWsM0r1QnIK4PKHd0FeS///x
TLSH
T1E2367D12B780C236D4AA473189AF43AA5778FD114B2687CB7384772E1E736D29F31B19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3264-0-0x0000000000220000-0x0000000000283000-memory.dmp

Download

memory/5052-4-0x0000000000590000-0x00000000005F3000-memory.dmp