26222183d80018f1d740841e2304512df9613bee44b2f61daa8b8b64466f3b63

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
Size 21.0MB
Sample260810-eql18s1bqc
SHA256 26222183d80018f1d740841e2304512df9613bee44b2f61daa8b8b64466f3b63
MD5 b05c5a154e3b834354ea7ac7810b0029
SHA1 7f424d53a8b65c1390445f1b8e7cf04ca5e66126
SHA512 b353c1b9b81f9aff4f3ad9413de9635107ae7de3f82840cf8c68887bee5db74d1c772b4502fbca6225f8681e047ed526ff657744b3859b4ce1e23f759968d638
SSDEEP 393216:ePEnfqRooU+GpaqNOADN+snsgUSzMs1g:iEiRzfGpaqNNDN+seIg
TLSH
T17D27AE12FBC229E2C89200708C7FBB399A3D5D78473446D39790AE5D68732D2667778E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4476	2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4476	2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
4476	2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b05c5a154e3b834354ea7ac7810b0029_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_magniber_njrat.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.ini

Path C:\Users\Admin\AppData\Roaming\System-G\settings.ini
Size 144B
SHA256 15bcfff27846412c206acbc9de771e7d870870a47ca7589ed0a94bce9734ea36
MD5 08b14bd8d0f13e0fdd41c584a18f761e
SHA1 08d864c414c4d58c20a3cf12c21f69d03ae09c41
SHA512 d6e3b21051367f20f6bbacfb0da028927f7d80adefd54855e348fec33315268df9a6903468d495f91dde7ca3ef1fdf71aa51b718302d03711d97a74f96274b6a
TLSH
T18FC048DA215423B0E322003413C1E4E0BC92172B8002FE4530B1BBAD98C4B0015F6D40
MD5 SHA1 SHA512 TLSH

Submit Download