451ae0d13e9a85c48fbbb49cdee54a2a88c4049f6989152b52f8d0e5f81f8e41

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 14.0MB
Sample260806-cs6sbafd39
SHA256 451ae0d13e9a85c48fbbb49cdee54a2a88c4049f6989152b52f8d0e5f81f8e41
MD5 32e194aae9409aefb1ec491372947989
SHA1 65cc51bd0ab2eb7cec1db26763a6ee539ebe116e
SHA512 c2bcdb572c890b1d173ae896fc50d91c060943e7a2e3d9e89357876031ba8989e317ad2cf1d3dccf6ddb3bb8866104e8fe13d15c77075798a9f9da8772b063f3
SSDEEP 196608:YQuDZpjwRJ0GPhsampDfoYD8+9mKMVMs:YQk3wRJJP9mZ4SiMs
TLSH
T128E69E13FF9349F2CC920070D47FB77A892D5D65472056E397A05F2EA8222D1263BB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3616	2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3616	2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
3616	2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_32e194aae9409aefb1ec491372947989_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.ini

Path C:\Users\Admin\AppData\Roaming\System-G\settings.ini
Size 144B
SHA256 15bcfff27846412c206acbc9de771e7d870870a47ca7589ed0a94bce9734ea36
MD5 08b14bd8d0f13e0fdd41c584a18f761e
SHA1 08d864c414c4d58c20a3cf12c21f69d03ae09c41
SHA512 d6e3b21051367f20f6bbacfb0da028927f7d80adefd54855e348fec33315268df9a6903468d495f91dde7ca3ef1fdf71aa51b718302d03711d97a74f96274b6a
TLSH
T18FC048DA215423B0E322003413C1E4E0BC92172B8002FE4530B1BBAD98C4B0015F6D40
MD5 SHA1 SHA512 TLSH

Submit Download