06e8af56fb9b687a40304ff9919f21e198e1a367ddf80b9b65a1762fbdfdecc8

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_c0f825bc2306cb0e797234ac089cd9c3_amadey_coinminer_elex_glassworm_lightspy_luca-stealer_ly.exe
Size 4.5MB
Sample260808-ms2tgadq41
SHA256 06e8af56fb9b687a40304ff9919f21e198e1a367ddf80b9b65a1762fbdfdecc8
MD5 c0f825bc2306cb0e797234ac089cd9c3
SHA1 ac2d71ac29c29afb00308461b339f0ef5e69745d
SHA512 3023e20f17ca23a13788760d2e24f31bdfa8b567ca5d4b3a15fa8366f11a83c8321a51a6f7dcc79707b02f5e8155534f50cc6320694035c7794d1cd48fa924f5
SSDEEP 98304:9hHnU3yKnoeAbNPus3xc6uNtqZjS+9xsfVVn+w2C2bRjboL6H:9hU3EFxk+wB2bRo6H
TLSH
T19326BE51BB82C4B6D99201F465BFAB7E083D6E384B34D4C3E7D11E7A48704C3663A76A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-08_c0f825bc2306cb0e797234ac089cd9c3_amadey_coinminer_elex_glassworm_lightspy_luca-stealer_ly.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_c0f825bc2306cb0e797234ac089cd9c3_amadey_coinminer_elex_glassworm_lightspy_luca-stealer_ly.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_c0f825bc2306cb0e797234ac089cd9c3_amadey_coinminer_elex_glassworm_lightspy_luca-stealer_ly.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_c0f825bc2306cb0e797234ac089cd9c3_amadey_coinminer_elex_glassworm_lightspy_luca-stealer_ly.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads