Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 10:53
General
- Target 2026-08-14_0f702c0d102d833ca6f8a1621356110b_amadey_coinminer_darkgate_elex_glassworm_nymaim_rhadamanthys_smoke-loader.exe
- Size 8.2MB
- Sample260814-mzgrwasvbw
- SHA256 bda4a1067c2f39c77f1f51bad25d36f5eb53f3536945a5307e119d89e7e9c71d
Malware Config
Signatures
- Loads dropped DLL 9 IoCs
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Drops file in Program Files directory 5 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_0f702c0d102d833ca6f8a1621356110b_amadey_coinminer_darkgate_elex_glassworm_nymaim_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0f702c0d102d833ca6f8a1621356110b_amadey_coinminer_darkgate_elex_glassworm_nymaim_rhadamanthys_smoke-loader.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c for /f "tokens=2" %a in ('tasklist ^| findstr /i "mark"') do @echo %a2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c tasklist | findstr /i "mark"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Discovers running processes
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\findstr.exefindstr /i "mark"4⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
set.ini
EThread.fne
ExuiKrnln.fne
dp1.fne
krnln.fnr
sqlite3.fne
HpSocket4C.dll
memory/2228-25-0x0000000002AE0000-0x0000000002B39000-memory.dmp
memory/2228-0-0x0000000000400000-0x00000000009E9000-memory.dmp
memory/2228-36-0x0000000007530000-0x000000000774A000-memory.dmp
memory/2228-22-0x00000000027F0000-0x000000000281E000-memory.dmp
memory/2228-42-0x000000000EE50000-0x000000000EE6C000-memory.dmp
memory/2228-16-0x0000000002A60000-0x0000000002ADC000-memory.dmp
memory/2228-126-0x0000000000400000-0x00000000009E9000-memory.dmp