1b5c754c6cf96b160517174a3a06f7736a53f35eb7fc65c6def87e03f53e8197

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe
Size 26.3MB
Sample260813-labc5avwf1
SHA256 1b5c754c6cf96b160517174a3a06f7736a53f35eb7fc65c6def87e03f53e8197
MD5 6cd63a45dbe7d57d48800b3f1d52b3b1
SHA1 158c007029422481fc29195c71aa2d6f8995478a
SHA512 963ee125833738faea44b511029d18ccd9b1fff687111d78bf0c626f46933d213a5bd7a73d650e73727567547c7e7bb13c7d7bc90fe340a71c22e0ece76d2684
SSDEEP 786432:SRkdObGXYzt+GFPt7lgx+SSuiy2Qx7dH//:Akd4zUGJt7lgLSuiy2Qx7dH//
TLSH
T104579D12ABD740B5F9B3023099ADE72A867FB9310531C91FF74C1A4D9B33A915A67323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4940	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
4592	files.dat
6032	rld34365.exe
4860	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe
4912	oinstrun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5096	cmd.exe
5228	cmd.exe
4064	cmd.exe
5400	cmd.exe
5728	cmd.exe
5824	cmd.exe
1540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld34365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2016	PING.EXE
2772	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OUTLOOK.EXE

Runs .reg file with regedit 1 IoCs

pid	Process
3356	regedit.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2016	PING.EXE
2772	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5912	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4132	WMIC.exe
4132	WMIC.exe
4132	WMIC.exe
4132	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
6048	WMIC.exe
4940	powershell.exe
4940	powershell.exe
4460	WMIC.exe
4460	WMIC.exe
4460	WMIC.exe
4460	WMIC.exe
4716	WMIC.exe
4716	WMIC.exe
4716	WMIC.exe
4716	WMIC.exe
4912	oinstrun.exe
4912	oinstrun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5912	OUTLOOK.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4132	WMIC.exe
Token: SeSecurityPrivilege	4132	WMIC.exe
Token: SeTakeOwnershipPrivilege	4132	WMIC.exe
Token: SeLoadDriverPrivilege	4132	WMIC.exe
Token: SeSystemProfilePrivilege	4132	WMIC.exe
Token: SeSystemtimePrivilege	4132	WMIC.exe
Token: SeProfSingleProcessPrivilege	4132	WMIC.exe
Token: SeIncBasePriorityPrivilege	4132	WMIC.exe
Token: SeCreatePagefilePrivilege	4132	WMIC.exe
Token: SeBackupPrivilege	4132	WMIC.exe
Token: SeRestorePrivilege	4132	WMIC.exe
Token: SeShutdownPrivilege	4132	WMIC.exe
Token: SeDebugPrivilege	4132	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4132	WMIC.exe
Token: SeRemoteShutdownPrivilege	4132	WMIC.exe
Token: SeUndockPrivilege	4132	WMIC.exe
Token: SeManageVolumePrivilege	4132	WMIC.exe
Token: 33	4132	WMIC.exe
Token: 34	4132	WMIC.exe
Token: 35	4132	WMIC.exe
Token: 36	4132	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6048	WMIC.exe
Token: SeSecurityPrivilege	6048	WMIC.exe
Token: SeTakeOwnershipPrivilege	6048	WMIC.exe
Token: SeLoadDriverPrivilege	6048	WMIC.exe
Token: SeSystemProfilePrivilege	6048	WMIC.exe
Token: SeSystemtimePrivilege	6048	WMIC.exe
Token: SeProfSingleProcessPrivilege	6048	WMIC.exe
Token: SeIncBasePriorityPrivilege	6048	WMIC.exe
Token: SeCreatePagefilePrivilege	6048	WMIC.exe
Token: SeBackupPrivilege	6048	WMIC.exe
Token: SeRestorePrivilege	6048	WMIC.exe
Token: SeShutdownPrivilege	6048	WMIC.exe
Token: SeDebugPrivilege	6048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6048	WMIC.exe
Token: SeRemoteShutdownPrivilege	6048	WMIC.exe
Token: SeUndockPrivilege	6048	WMIC.exe
Token: SeManageVolumePrivilege	6048	WMIC.exe
Token: 33	6048	WMIC.exe
Token: 34	6048	WMIC.exe
Token: 35	6048	WMIC.exe
Token: 36	6048	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6048	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE
5912	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 4188	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	89
PID 5820 wrote to memory of 5096	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	90
PID 5096 wrote to memory of 4132	5096	cmd.exe	93
PID 5820 wrote to memory of 5228	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	94
PID 5228 wrote to memory of 4592	5228	cmd.exe	97
PID 5820 wrote to memory of 4064	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	98
PID 4064 wrote to memory of 6048	4064	cmd.exe	100
PID 5820 wrote to memory of 4940	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	101
PID 5820 wrote to memory of 4288	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	103
PID 5820 wrote to memory of 1600	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	105
PID 5820 wrote to memory of 4216	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	107
PID 5820 wrote to memory of 3540	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	109
PID 5820 wrote to memory of 5400	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	111
PID 5820 wrote to memory of 5912	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	113
PID 5820 wrote to memory of 6032	5820	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	114
PID 5400 wrote to memory of 3356	5400	cmd.exe	115
PID 6032 wrote to memory of 4860	6032	rld34365.exe	117
PID 6032 wrote to memory of 5728	6032	rld34365.exe	118
PID 4860 wrote to memory of 2404	4860	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	119
PID 4860 wrote to memory of 5824	4860	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	121
PID 5728 wrote to memory of 2016	5728	cmd.exe	124
PID 5824 wrote to memory of 4460	5824	cmd.exe	125
PID 4860 wrote to memory of 1540	4860	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	126
PID 1540 wrote to memory of 4716	1540	cmd.exe	128
PID 4860 wrote to memory of 4912	4860	2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe	129
PID 5728 wrote to memory of 2772	5728	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
  2⤵
  PID:4188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5228
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4592
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServiceName /t REG_SZ /d kms.loli.best /f
  2⤵
  PID:4288
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /t REG_SZ /d 1688 /f
  2⤵
  PID:1600
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServiceName /t REG_SZ /d kms.loli.best /f
  2⤵
  PID:4216
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v KeyManagementServicePort /t REG_SZ /d 1688 /f
  2⤵
  PID:3540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /D /c regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\regedit.exe
    regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
    3⤵
    - Runs .reg file with regedit
    PID:3356
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5912
- C:\Users\Admin\AppData\Local\Temp\rld34365.exe
  "C:\Users\Admin\AppData\Local\Temp\rld34365.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe" 1000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\reg.exe
      "C:\Windows\System32\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
      4⤵
      PID:2404
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5824
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4460
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
      "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD23493.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5728
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2016
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-13_6cd63a45dbe7d57d48800b3f1d52b3b1_amadey_coinminer_cryptbot_darkgate_glassworm_luca-steale.exe
Size 26.3MB
SHA256 1b5c754c6cf96b160517174a3a06f7736a53f35eb7fc65c6def87e03f53e8197
MD5 6cd63a45dbe7d57d48800b3f1d52b3b1
SHA1 158c007029422481fc29195c71aa2d6f8995478a
SHA512 963ee125833738faea44b511029d18ccd9b1fff687111d78bf0c626f46933d213a5bd7a73d650e73727567547c7e7bb13c7d7bc90fe340a71c22e0ece76d2684
SSDEEP 786432:SRkdObGXYzt+GFPt7lgx+SSuiy2Qx7dH//:Akd4zUGJt7lgLSuiy2Qx7dH//
TLSH
T104579D12ABD740B5F9B3023099ADE72A867FB9310531C91FF74C1A4D9B33A915A67323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfD23493.bat

Path C:\Users\Admin\AppData\Local\Temp\SelfD23493.bat
Size 157B
SHA256 88e9562576dc7a07ae2e4ea07ec6295e20c92ea0518c742669adf6fcb4660ef2
MD5 4275552aac34427046ea4002fbf64c3d
SHA1 11657ca903f4c6752f9f3f972ed3effd706a685f
SHA512 18a25887fe0e1fe17d67c5e83b249451723b7badebd1fa36e403eae58c5007690e6c4beb4b615c8ae0a5053378cf46748a98978bc9ade219cdc8d55ca8296756
TLSH
T1A3C080504AC7C7560498927B1AD8D14CC075CC4E3F452712A7204C5C814111C6740703
MD5 SHA1 SHA512 TLSH

Submit Download

configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\configure.xml
Size 1KB
SHA256 1bfdc28b84ae493c04666c0e3e140c3f98472d29ca18b3473ede659095f5730f
MD5 13ccb534fc5bdc54d621d70949cfbebd
SHA1 b40b0f965101fe524dc92d6b415d42097a94efbf
SHA512 2859f2cd13c7ffef3ddc8e2898044d28b8aca5461ca4bc38a7e3ec552dcbdde63dbb72a0d2388026fdbe63d3947c7ebd239322ae05b1e29e71fcb5e25ed1bbd8
TLSH
T1B321049A6E895C7C76364322F296CFC8BF395513971418B070CF6A2B6F62164036B09F
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 765KB
SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
MD5 bb5569b15d68c10b7ff2d96b45825120
SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
TLSH
T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 7.3MB
SHA256 caf295438040eca0632d475eeecf51a16307a23cb87dcfce796d274e8e8ff221
MD5 6b6f44e4ef1ee8fb94ea28aed02964fb
SHA1 c9f845c97b5c5863682c2f38f8f1ed26377b4dfb
SHA512 3227a32cf7bc64354ce81f7959299da612bc8a180aec0fafdd2d335354f85739984e389630ef5b9663cf98797a28f2ea0eb44cec6c905db50099a908cca11bd6
SSDEEP 196608:hXqTPuiy2bA5G4GGxNd226ALHcXSHo36r6weCUJaI6HMaJTtGb8b:tSuiy2Qx76ALHqK6wxBb
TLSH
T1E4766C2277E78076E5F202706DFDAB1985BDBE7119F0811F62881A1E0A70BB195E7733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newui.reg

Path C:\Users\Admin\AppData\Local\Temp\newui.reg
Size 1KB
SHA256 92dc5f009e30e42d18b80fdcce0e029df6d56e387eb38e16c5585a9c5a0b41a7
MD5 7fb2bda7ca25568909eab0b872416ada
SHA1 23295a06a82a9ef408ec0409e6bc5f15c045c895
SHA512 ea07f1a90991410d044bfc0420c2de4d2e445b30c62199277ab26b9a8ba11603e0652caa24bb26a2429cc6c12d76fc627751476b133158617e4439a7e59a883d
TLSH
T14B31F593E0158632E0553F1175932F893BBA03C77467ADE6832940D42266957C3D7AB7
MD5 SHA1 SHA512 TLSH

Submit Download

oinstrun.exe

Path C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
Size 14KB
SHA256 4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d
MD5 32973232138fc6b30d913167096c059d
SHA1 d6a7cb95d5525ea3d7286749663e12c1addb3104
SHA512 ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f
SSDEEP 384:t0TE7lQWycenV30bCeFBgb4kkAeZn9N9TsW0ClG6VEu2QWGrWvNUTsrwHaU:t0T0lQhUs
TLSH
T1FA62A38097EC4499F0FB4F30EDBA41029ABAFD515E75D12F0150508E1AB2B61DE7AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rld34365.exe

Path C:\Users\Admin\AppData\Local\Temp\rld34365.exe
Size 16KB
SHA256 03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f
MD5 fc8ec75b7b5f3a2be9fdc67ee8808afa
SHA1 e5723567f6f3d12c2eaea3d07955cf5a259c8a8f
SHA512 c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a
SSDEEP 192:WnI7XWYyywYGoT8uiAe+jlsSUFagW+b43iyRJvaofC1upLKLw9glGfqWJJR48F8:YWGYyjuQ++SUcgxNualcpLT9wGlJM8O
TLSH
T1AB722A23EEC168F6E6D380B30BB59927DD35121153444AD7E3EC9DA93B105D0E73A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ver.txt

Path C:\Users\Admin\AppData\Local\Temp\ver.txt
Size 71KB
SHA256 4b6de49c99cb5e5d0e2e82296b5c23375434faffa3ceb2861f34514edc40cf47
MD5 77260eca6a2463ec62d71e94354217df
SHA1 c63b2af3419645fc7f6a608bb1304be4a29ff634
SHA512 3433193c2e2bbf267659ca8a51ce9a8b55e47c3e5815952eaff079a3c81fe2aef6d733e6fe9937c93bdde141ba07ffb088cc9b7a539b6d393fe074640053798c
SSDEEP 1536:Kd4kolB1XW5A8jLmRVXQjehjH+P2SnSTjlldcVdFodOlav+Df+XLpCHk2IIoB8TA:C0
TLSH
T18F632562C9724EBB2EB4332859B48742F6F023DF12901C4B35BE1E6D4F375226275E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4940-28-0x000002B4B5AE0000-0x000002B4B5B02000-memory.dmp

Download

memory/5912-54-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/5912-55-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/5912-56-0x00007FFB8E3F0000-0x00007FFB8E400000-memory.dmp

Download

memory/5912-51-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/5912-53-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/5912-52-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/5912-49-0x00007FFB91060000-0x00007FFB91070000-memory.dmp

Download

memory/5912-97-0x0000028D80D70000-0x0000028D80DA0000-memory.dmp

Download