Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe
Resource
win11ltsc2024-20260710-en
2 signatures
150 seconds
General
- Target 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe
- Size 3.2MB
- Sample260809-s8rlbstwgx
- SHA256 cbe0785f0285e14f311e68b0650449dd8b045cc7cf2611612bc0df29fe832d50
- MD5 e92a050d050db5e98465a8f0dc3ead38
- SHA1 2469d8e241fdad47ff3fbfd558430ae813d3d17f
- SHA512 2adedfc6f4160d7bf0431ca422f2acc595de5d8cec7f29c57b2801a089a16e2cb336b8d825959f93010e34fa1f69829748bd4c8cb3f246534e1ab235ad8b5798
- SSDEEP 49152:oXI4rIwUC5cNeyzSggggMm8eGyaQubbywdzwFOZH9Z4pKP/h7NfLie79WniR/6da:0Iw0eyzHevaLSJgZd0ghtEn6D
- TLSH T1A1F5AE12FA429832E9E3007545BE6B7E8D39BA30033894D397D41E799F316E17A3635B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe 4956 2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e92a050d050db5e98465a8f0dc3ead38_amadey_coinminer_darkgate_elex_glassworm_graphican_hijac.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4956