xmrig | e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0

Analysis

max time kernel
96s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
Size 49.4MB
Sample260804-pfhk6swvbx
SHA256 e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0
MD5 43540381dc8b0fa7688c59465a8a6295
SHA1 eeb5196166e13aa8c4aa266b42e998a86b55ade1
SHA512 fcc7dd431f30485710215e0c87f76c94cbff5acb4cb2ccd8182e4a251d58d9f31849ad82f65088810dabe8175c7607a89e3650c9b24f6fbd5c2aff594c2fbc07
SSDEEP 786432:QYe+pJFC9zaouyEeNMhZl05Yt+kTVTL/xlFVaP:keZA6+kTVTL/xlF
TLSH
T16FB77C53F85144E0D4EAD134863AD65BBA717C658B3023C72B64FA642F7AFD0A67E308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation spyware trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c00000001c5e8-116.dat	family_xmrig
behavioral2/files/0x000c00000001c5e8-116.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2944	powershell.exe
4432	powershell.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4304	netsh.exe
4228	netsh.exe
1240	netsh.exe
1308	netsh.exe

Executes dropped EXE 8 IoCs

pid	Process
2644	player.exe
980	LauncherW1.exe
3596	LauncherW2.exe
2128	KryptexService.exe
3776	kryptex_xmrig.exe
5588	console-util.exe
2700	console-util.exe
3396	console-util.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	KryptexService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	KryptexService.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	player.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	player.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	player.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-608"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl\ = "ShockwaveFlash.ShockwaveFlash"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swf\ = "ShockwaveFlash.ShockwaveFlash"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-205"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.spl	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-202"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\shell\open\command	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a\ = "FlashPlayer.AudioForFlashPlayer"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-204"	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4p\ = "FlashPlayer.ProtectedMediaForFlashPlayer"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.VideoForFlashPlayer\DefaultIcon\ = "C:\\ProgramData\\Launcher\\player.exe,-203"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.f4a	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.ProtectedMediaForFlashPlayer\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\shell\open\command	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\shell\open	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.FlashVideo\DefaultIcon	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command	player.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\shell\open\command\ = "\"C:\\ProgramData\\Launcher\\player.exe\" %1"	player.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FlashPlayer.AudioForFlashPlayer\DefaultIcon	player.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	KryptexService.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
3596	LauncherW2.exe
980	LauncherW1.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe
2944	powershell.exe
2944	powershell.exe
2944	powershell.exe
3596	LauncherW2.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
980	LauncherW1.exe
3596	LauncherW2.exe
3596	LauncherW2.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
980	LauncherW1.exe
3596	LauncherW2.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
980	LauncherW1.exe
3596	LauncherW2.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
980	LauncherW1.exe
3596	LauncherW2.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
3596	LauncherW2.exe
980	LauncherW1.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
Token: SeDebugPrivilege	980	LauncherW1.exe
Token: SeDebugPrivilege	3596	LauncherW2.exe
Token: SeIncreaseQuotaPrivilege	2128	KryptexService.exe
Token: SeSecurityPrivilege	2128	KryptexService.exe
Token: SeTakeOwnershipPrivilege	2128	KryptexService.exe
Token: SeLoadDriverPrivilege	2128	KryptexService.exe
Token: SeSystemProfilePrivilege	2128	KryptexService.exe
Token: SeSystemtimePrivilege	2128	KryptexService.exe
Token: SeProfSingleProcessPrivilege	2128	KryptexService.exe
Token: SeIncBasePriorityPrivilege	2128	KryptexService.exe
Token: SeCreatePagefilePrivilege	2128	KryptexService.exe
Token: SeBackupPrivilege	2128	KryptexService.exe
Token: SeRestorePrivilege	2128	KryptexService.exe
Token: SeShutdownPrivilege	2128	KryptexService.exe
Token: SeDebugPrivilege	2128	KryptexService.exe
Token: SeSystemEnvironmentPrivilege	2128	KryptexService.exe
Token: SeRemoteShutdownPrivilege	2128	KryptexService.exe
Token: SeUndockPrivilege	2128	KryptexService.exe
Token: SeManageVolumePrivilege	2128	KryptexService.exe
Token: 33	2128	KryptexService.exe
Token: 34	2128	KryptexService.exe
Token: 35	2128	KryptexService.exe
Token: 36	2128	KryptexService.exe
Token: SeCreatePagefilePrivilege	2128	KryptexService.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeIncreaseQuotaPrivilege	2944	powershell.exe
Token: SeSecurityPrivilege	2944	powershell.exe
Token: SeTakeOwnershipPrivilege	2944	powershell.exe
Token: SeLoadDriverPrivilege	2944	powershell.exe
Token: SeSystemProfilePrivilege	2944	powershell.exe
Token: SeSystemtimePrivilege	2944	powershell.exe
Token: SeProfSingleProcessPrivilege	2944	powershell.exe
Token: SeIncBasePriorityPrivilege	2944	powershell.exe
Token: SeCreatePagefilePrivilege	2944	powershell.exe
Token: SeBackupPrivilege	2944	powershell.exe
Token: SeRestorePrivilege	2944	powershell.exe
Token: SeShutdownPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeSystemEnvironmentPrivilege	2944	powershell.exe
Token: SeRemoteShutdownPrivilege	2944	powershell.exe
Token: SeUndockPrivilege	2944	powershell.exe
Token: SeManageVolumePrivilege	2944	powershell.exe
Token: 33	2944	powershell.exe
Token: 34	2944	powershell.exe
Token: 35	2944	powershell.exe
Token: 36	2944	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeIncreaseQuotaPrivilege	4432	powershell.exe
Token: SeSecurityPrivilege	4432	powershell.exe
Token: SeTakeOwnershipPrivilege	4432	powershell.exe
Token: SeLoadDriverPrivilege	4432	powershell.exe
Token: SeSystemProfilePrivilege	4432	powershell.exe
Token: SeSystemtimePrivilege	4432	powershell.exe
Token: SeProfSingleProcessPrivilege	4432	powershell.exe
Token: SeIncBasePriorityPrivilege	4432	powershell.exe
Token: SeCreatePagefilePrivilege	4432	powershell.exe
Token: SeBackupPrivilege	4432	powershell.exe
Token: SeRestorePrivilege	4432	powershell.exe
Token: SeShutdownPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeSystemEnvironmentPrivilege	4432	powershell.exe
Token: SeRemoteShutdownPrivilege	4432	powershell.exe
Token: SeUndockPrivilege	4432	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3776	kryptex_xmrig.exe
2700	console-util.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	player.exe
2644	player.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2644	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	88
PID 1224 wrote to memory of 4920	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	89
PID 1224 wrote to memory of 980	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	93
PID 980 wrote to memory of 4132	980	LauncherW1.exe	94
PID 1224 wrote to memory of 3596	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	95
PID 1224 wrote to memory of 2128	1224	2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe	96
PID 3596 wrote to memory of 4564	3596	LauncherW2.exe	98
PID 980 wrote to memory of 2564	980	LauncherW1.exe	100
PID 2128 wrote to memory of 4304	2128	KryptexService.exe	103
PID 3596 wrote to memory of 4612	3596	LauncherW2.exe	104
PID 980 wrote to memory of 4736	980	LauncherW1.exe	105
PID 2128 wrote to memory of 4228	2128	KryptexService.exe	106
PID 3596 wrote to memory of 2860	3596	LauncherW2.exe	108
PID 980 wrote to memory of 4720	980	LauncherW1.exe	109
PID 2128 wrote to memory of 2944	2128	KryptexService.exe	110
PID 3596 wrote to memory of 5900	3596	LauncherW2.exe	111
PID 980 wrote to memory of 2300	980	LauncherW1.exe	112
PID 3596 wrote to memory of 1848	3596	LauncherW2.exe	113
PID 980 wrote to memory of 3916	980	LauncherW1.exe	114
PID 2128 wrote to memory of 4432	2128	KryptexService.exe	115
PID 980 wrote to memory of 3044	980	LauncherW1.exe	116
PID 3596 wrote to memory of 960	3596	LauncherW2.exe	117
PID 980 wrote to memory of 4352	980	LauncherW1.exe	118
PID 3596 wrote to memory of 5400	3596	LauncherW2.exe	119
PID 2128 wrote to memory of 1240	2128	KryptexService.exe	120
PID 3596 wrote to memory of 928	3596	LauncherW2.exe	121
PID 980 wrote to memory of 4208	980	LauncherW1.exe	122
PID 3596 wrote to memory of 4868	3596	LauncherW2.exe	124
PID 980 wrote to memory of 2980	980	LauncherW1.exe	125
PID 2128 wrote to memory of 1308	2128	KryptexService.exe	126
PID 980 wrote to memory of 2404	980	LauncherW1.exe	127
PID 3596 wrote to memory of 3660	3596	LauncherW2.exe	128
PID 3596 wrote to memory of 1348	3596	LauncherW2.exe	129
PID 980 wrote to memory of 4916	980	LauncherW1.exe	130
PID 2128 wrote to memory of 3776	2128	KryptexService.exe	131
PID 980 wrote to memory of 2168	980	LauncherW1.exe	133
PID 3596 wrote to memory of 4072	3596	LauncherW2.exe	134
PID 2128 wrote to memory of 5588	2128	KryptexService.exe	135
PID 2128 wrote to memory of 2700	2128	KryptexService.exe	136
PID 2128 wrote to memory of 3396	2128	KryptexService.exe	137
PID 3596 wrote to memory of 3236	3596	LauncherW2.exe	138
PID 980 wrote to memory of 2204	980	LauncherW1.exe	139
PID 980 wrote to memory of 5868	980	LauncherW1.exe	140
PID 3596 wrote to memory of 2752	3596	LauncherW2.exe	141
PID 980 wrote to memory of 1288	980	LauncherW1.exe	142
PID 3596 wrote to memory of 4792	3596	LauncherW2.exe	143
PID 980 wrote to memory of 5320	980	LauncherW1.exe	144
PID 3596 wrote to memory of 716	3596	LauncherW2.exe	145
PID 3596 wrote to memory of 2096	3596	LauncherW2.exe	146
PID 980 wrote to memory of 5068	980	LauncherW1.exe	199
PID 3596 wrote to memory of 4232	3596	LauncherW2.exe	148
PID 980 wrote to memory of 4964	980	LauncherW1.exe	149

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\ProgramData\Launcher\player.exe
  "C:\ProgramData\Launcher\player.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2644
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /F /TN "LauncherAutostart" /TR "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe" /SC ONLOGON /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4920
- C:\ProgramData\Launcher\LauncherW1.exe
  "C:\ProgramData\Launcher\LauncherW1.exe" --watch
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4132
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4916
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5868
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4964
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5116
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1192
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:6048
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5800
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2640
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:360
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5716
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5124
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1928
- C:\ProgramData\Launcher\LauncherW2.exe
  "C:\ProgramData\Launcher\LauncherW2.exe" --watch
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4564
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4612
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5900
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:716
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4616
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:704
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5004
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3568
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1268
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5340
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe"
    3⤵
    PID:1020
- C:\ProgramData\Launcher\KryptexService.exe
  "C:\ProgramData\Launcher\KryptexService.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule "name=Kryptex Service"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule "name=Kryptex Service" dir=in action=Allow program=C:\ProgramData\Launcher\KryptexService.exe enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Launcher'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Launcher\miners'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall show rule name=xmrig
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name=xmrig dir=in action=Allow program=C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1308
- - C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe
    miners\xmrig\v6.26.0\kryptex_xmrig.exe --coin XMR --url stratum+tcp://xmr-eu.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v246739257 --pass x --url stratum+tcp://xmr-ru.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v246739257 --pass x --url stratum+tcp://xmr-us.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v246739257 --pass x --url stratum+tcp://xmr-sg.kryptex.network:7029 --user 86nZuEoK9G2YCBPQKupf4dTVT6AiVnfSaiRPm9xAbj6SL3wbSdR6wWwDhV59W1RULyRQXQARiv9Z2jMKCTye6TcLLURm5LG/v246739257 --pass x --http-host 127.0.0.1 --http-port 12000 --log-file logs/2026-08-04T12-21-22.825Z_00-00-0_Intel-Core_xmr-randomx_xmrig_log.txt --keepalive --cpu-max-threads-hint 75
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:3776
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe title 3776 "xmrig v6.26.0 xmr-randomx"
    3⤵
    - Executes dropped EXE
    PID:5588
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe appusermodelid 3776 org.kryptex.kryptex
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:2700
- - C:\ProgramData\Launcher\console-util.exe
    C:\ProgramData\Launcher\console-util.exe noselect 3776
    3⤵
    - Executes dropped EXE
    PID:3396

C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-03_43540381dc8b0fa7688c59465a8a6295_cobalt-strike_coinminer_darkgate_dosia_glassworm_icedid_.exe
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KryptexService.exe

Path C:\ProgramData\Launcher\KryptexService.exe
Size 32.7MB
SHA256 147985f6351ec134a7436e89a9f310af2e978befa0016ad5c3973c8bc30e54ae
MD5 a65660dbf9f261c2d9106d5d204e4249
SHA1 ff104d8e833af2913b80d915fc18e46f4b1e2eaf
SHA512 a2e3a0afde98db9dc27a01c940ccb7c75f42af5c86cd53f292a15d36083fdb1d8a2bd02b36d0b584e173abec77fc28b79a02af7898c21cd2b2b3c9a382fa5a8d
SSDEEP 196608:73Ili+a+pmuH1fbEZnf6+7NiFBOt3zeWHai9aQK7fodoyEed80N8Mw9d:7Ye+ptMBiFBOZaC9zaouyEe/NfMd
TLSH
T16D774A53F85108E0D4EED630862A9253BF717C658B3123D76B64F7A42F7ABD0A67A304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LauncherW1.exe

Path C:\ProgramData\Launcher\LauncherW1.exe
Size 49.4MB
SHA256 e08dd05cdaf1ba515f90c49570ba66cf7f0fbd40d0ab48044ecd4c8f500aadb0
MD5 43540381dc8b0fa7688c59465a8a6295
SHA1 eeb5196166e13aa8c4aa266b42e998a86b55ade1
SHA512 fcc7dd431f30485710215e0c87f76c94cbff5acb4cb2ccd8182e4a251d58d9f31849ad82f65088810dabe8175c7607a89e3650c9b24f6fbd5c2aff594c2fbc07
SSDEEP 786432:QYe+pJFC9zaouyEeNMhZl05Yt+kTVTL/xlFVaP:keZA6+kTVTL/xlF
TLSH
T16FB77C53F85144E0D4EAD134863AD65BBA717C658B3023C72B64FA642F7AFD0A67E308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

console-util.exe

Path C:\ProgramData\Launcher\console-util.exe
Size 229KB
SHA256 f876b8d2347f0a3c7bb3c30f29ed74e76b25fa8aa0a2140b928d7bb4a6ec7334
MD5 afb5dbb468995437e3e0da6aeed2f164
SHA1 0a707f67f6811ab61833a02d50e350a169e3f817
SHA512 922330785cc25f16b71d45009326f55cf59ae32759f813142cf5b80834bd11d1248c9a30bf1c9395cfa245f05a99ebe4dffce0fb6ffe47f9d85761065fa6e808
SSDEEP 3072:4fbiDmJtgpNTTGmUUzq85jl7e6o3SgU+wdYs1E8rXdhF5e2peQ1:mEmJt+J95ziP3Soez5eQec
TLSH
T13D348E467BA410F5E9678538CC410906EAB3BC565BA1FACF03A04BB69F237D09E3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kryptex.db

Path C:\ProgramData\Launcher\kryptex.db
Size 372KB
SHA256 ebe679899331000925c29e88ef988bc89d77fb96ee9d4fd4cf5aa56e5cb554ce
MD5 539a3ddb35fd44550d4f75adb1ae6e41
SHA1 417e3fc5a72e9c65f8c80be62050782353481436
SHA512 408f7d3552e41d7e70b992473cfcb8c79220ffe25efac54dc2c610b48feaf665efc5b1cd9d754d38511cc64c37134db156d17a9c4ed9449b985fbc5b22955681
SSDEEP 768:eysHibKgBFysHibKgkwXHtpYRNlsFCVogH:eysHi9ysHiglsFrgH
TLSH
T1C584F41E2D08FAA1C4FB723761F155D3A939229A87F05CD262F0DCF0AAD6DC1C1179A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.path

Path C:\ProgramData\Launcher\main.path
Size 138B
SHA256 37e1721906114c998728457f3d9b5e50ce1875742c965ed1d376338f2dcaccd8
MD5 5b8009ea7c812640381aed3ae7e65563
SHA1 b334aa79a8da196d21973dfc86a7ffaada049f66
SHA512 dcf38f2f32ca144f439bb67eb662de45899b3ef8142402ad6e7c063843ba24148c86b07f54d200df5b837413e600713e036d736403bcb1ea090fdfbcd097e27b
TLSH
T1B1C02B048E5BCF90041AA24AA3901C0EC0F12C0A4B152333B730884E62A8847E2D4312
MD5 SHA1 SHA512 TLSH

Submit Download

kryptex_xmrig.exe

Path C:\ProgramData\Launcher\miners\xmrig\v6.26.0\kryptex_xmrig.exe
Size 6.2MB
SHA256 7f900c92233a5fdcc55db1cca0ed7829a5064eced3e9f7ecb033701712308d8a
MD5 229be00e1f179844aaa275a033cf6bdd
SHA1 631935a8cf408f40f95a1e1609fcd079e6985cf8
SHA512 9ee8a46fd4a722ce8f07004844646b2821a180691495aa8d998f244420439555a28d1e004a6e743207ad7e2c143af3c946c97b28c6552157d8af9f62fa7cb3cc
SSDEEP 98304:WbgDtqBRjgHYUUF/fjOIbYNUgeByYWitMQXfQzpoc3L4OZ3AMFBE107AVFHGQOBZ:Wu4Xjg4Wzp58OhAMFCCcFmTXCnhG
TLSH
T1C2569E26B7A400E8C87AC53CC6579607E7F2B8195370A7DB27B056AA1F336D45E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

player.exe

Path C:\ProgramData\Launcher\player.exe
Size 15.2MB
SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
MD5 08c13d0cc4ccdac79b38821e846a53b7
SHA1 7736efc1c76e6a80132a22e1f9fc87a5884fa375
SHA512 87e953e053e249a5c202ff4639aee6fa5915b0b86e69ad5eee76d9091545aa4d201a8477d1c2525db9d3ebb053476cfd9ef31a8c7b232a4dcf84c2dd86f35860
SSDEEP 393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP
TLSH
T12EF69D23A60144B1C182217DCC3AEEAD617DAE15873415C753A47C1BAA72FC3AA3DB5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 85326d55b60f1146add83a31b1622e3e8a4474e273b74a1715e7b0bb2c7f7696
MD5 fcf6401b53d950e6749338e3a413ee8e
SHA1 0b1214517f7a500be59e584a0803a0826179b82b
SHA512 0eac06a30cfcc51361852b8eca694e2ae7814608dca10d01a7a7a8a4e5f05778e3f00fc85cdc0a55135d208fb1bd5b811bcf167b0a2c1d9c4089f22e941ee00e
TLSH
T142216B33B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84D559A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0yrhseye.byf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0yrhseye.byf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1224-1-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-2-0x00000203843B0000-0x0000020387516000-memory.dmp

Download

memory/1224-60-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-63-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-65-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-16-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-0-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp

Download

memory/1224-3-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/1224-74-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/2128-100-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-98-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-82-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-176-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-119-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-127-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-110-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-171-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-161-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-155-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-149-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-90-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-132-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2128-143-0x00007FF630250000-0x00007FF632369000-memory.dmp

Download

memory/2944-69-0x00000202AC7C0000-0x00000202AC7E2000-memory.dmp

Download

memory/2944-75-0x00000202AC760000-0x00000202AC76A000-memory.dmp

Download

memory/2944-72-0x00000202AC9F0000-0x00000202ACA0E000-memory.dmp

Download

memory/2944-73-0x00000202ACA10000-0x00000202ACAC2000-memory.dmp

Download

memory/3776-118-0x0000024F15C20000-0x0000024F15C40000-memory.dmp

Download