Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 12:38
Behavioral task
behavioral1
Sample
2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe
- Size 2.6MB
- Sample260809-pvd7aser9s
- SHA256 be7378d9dcb990a14f5407f76158dbc97c154c3edc060aebea5ec044eb4422d9
- MD5 38edc14a18de932d35435aa13257684a
- SHA1 100ffa7c4d9e7943de26c197f487e555e664bc20
- SHA512 8afecdad9cd8f140406df496c6c5cf01b4585a825190ad5a3512f26448388d01bc5b3280f0380d19587c7189b0ecd8e67c47cbf901b06eda015215c1494e3c5f
- SSDEEP 49152:2TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:2KkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T1C2C59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000400000001dbe7-2.dat CryptoLocker_rule2 - Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000400000001dbe7-2.dat CryptoLocker_set1 - UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/4168-0-0x00000000009E0000-0x0000000000A69000-memory.dmp UPX behavioral1/files/0x000400000001dbe7-2.dat UPX behavioral1/memory/1272-3-0x00000000002F0000-0x0000000000379000-memory.dmp UPX behavioral1/memory/4168-15-0x00000000009E0000-0x0000000000A69000-memory.dmp UPX behavioral1/memory/1272-17-0x00000000002F0000-0x0000000000379000-memory.dmp UPX behavioral1/memory/4168-32-0x00000000009E0000-0x0000000000A69000-memory.dmp UPX behavioral1/memory/1272-33-0x00000000002F0000-0x0000000000379000-memory.dmp UPX behavioral1/memory/1272-39-0x00000000002F0000-0x0000000000379000-memory.dmp UPX behavioral1/memory/4168-50-0x00000000009E0000-0x0000000000A69000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 1272 e74746a1 - Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 4 223.5.5.5 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 35 114.114.114.114 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 41 223.5.5.5 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Destination IP 3 114.114.114.114 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Drops file in System32 directory 15 IoCs
description ioc Process File created C:\Windows\SysWOW64\e74746a1 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE e74746a1 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData e74746a1 -
resource yara_rule behavioral1/memory/4168-0-0x00000000009E0000-0x0000000000A69000-memory.dmp upx behavioral1/files/0x000400000001dbe7-2.dat upx behavioral1/memory/1272-3-0x00000000002F0000-0x0000000000379000-memory.dmp upx behavioral1/memory/4168-15-0x00000000009E0000-0x0000000000A69000-memory.dmp upx behavioral1/memory/1272-17-0x00000000002F0000-0x0000000000379000-memory.dmp upx behavioral1/memory/4168-32-0x00000000009E0000-0x0000000000A69000-memory.dmp upx behavioral1/memory/1272-33-0x00000000002F0000-0x0000000000379000-memory.dmp upx behavioral1/memory/1272-39-0x00000000002F0000-0x0000000000379000-memory.dmp upx behavioral1/memory/4168-50-0x00000000009E0000-0x0000000000A69000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\15c6f0 e74746a1 File opened for modification C:\Windows\475b90 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e74746a1 Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" e74746a1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ e74746a1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" e74746a1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" e74746a1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" e74746a1 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" e74746a1 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing e74746a1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix e74746a1 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" e74746a1 - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 1272 e74746a1 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeTcbPrivilege 4168 2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe Token: SeDebugPrivilege 1272 e74746a1 Token: SeTcbPrivilege 1272 e74746a1
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_38edc14a18de932d35435aa13257684a_amadey_coinminer_cryptolocker_elex_glassworm_kwampirs_ma.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
C:\Windows\Syswow64\e74746a1C:\Windows\Syswow64\e74746a11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\15c6f0
- Size 506B
- SHA256 0e9cc43819f3da19fa47a85f04c3c24ed1979b4d3e5e8a2f58fb8ff7893a7937
- MD5 af50f5b324b0562fa33ea53a57c6c002
- SHA1 9f1cbd3677400e9729b4c330f2b66d16a1df89cd
- SHA512 1869bac4a26f5e2cc76529d28f7f4ba9fa48a8fc2e9759b85d02b6db9db22917f5bc1383151c1dae1774d2e705c38d1db8fb7a1d7439b1ec7f02b620d3265ff1
- TLSH T15DF0057DDE9033D92DAD186BCB0675084818913B404771C52F54316804DE146EF3384D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\e74746a1
- Size 2.6MB
- SHA256 2645a2ea6b5e9dc6b92c609e238078f36bb29637b7d06d43927b8c45762551f3
- MD5 f00e72607e1753e2305273f9f8885e8c
- SHA1 924ed4941e5e55494d8837942aed385e1ea6474c
- SHA512 6e36fb49f1021d61ad028d97a46fbeb75e34787226446cfbea6077165ea98abd7b6af7002fc66033a03d06f7df1224c26ef33afda9d0c3211bdd8482ab22cce5
- SSDEEP 49152:+TGkQy56/OJdJCXDrsOFZMjHfUTGkQy5QZuTtS0rQMYOF:+KkVkOhCXHHFZMjHfUKkVWsM0r1F
- TLSH T12CC59F31B7818036D1B7427186FA47BBA5297C211715A5CF73C87A2A1FB36D2AE3170E
- MD5 SHA1 SHA512 SSDEEP TLSH