2d59e109e667e26f6e3a6512d389c6c6691b31581d6b6b92ace93e9fca9c76ae

General

Target
2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Size 1.1MB
Sample260815-dvrlvaej6w
SHA256 2d59e109e667e26f6e3a6512d389c6c6691b31581d6b6b92ace93e9fca9c76ae
MD5 be6def8b3e5c22ccd4be8668ca47b885
SHA1 860f64e050f5438b1ed9323f378e8074cf2024e3
SHA512 0707a37ca99ccd65cace527f3509a4394dcda1c2b1490f0d6fcc5fd28a53fce9f4b2de0c0182655224070bcc15964a5cb7fb7dce078f0944bd2962015d8c8d23
SSDEEP 24576:0vO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:0HHKO29QGhuTtS0rQi
TLSH
T1A3359E31E241C036D4A70176C6B94BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3864	bab46a68

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	31	114.114.114.114	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	32	223.5.5.5	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	3	114.114.114.114	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	4	223.5.5.5	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AAD646CB44373074ADE741C38400E7E1	bab46a68
File created	C:\Windows\SysWOW64\bab46a68	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	bab46a68
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AAD646CB44373074ADE741C38400E7E1	bab46a68

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\422730	bab46a68
File opened for modification	C:\Windows\a22a0	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bab46a68

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bab46a68
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bab46a68
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bab46a68
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bab46a68
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bab46a68
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bab46a68
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bab46a68
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bab46a68
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bab46a68

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
3864	bab46a68
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeTcbPrivilege	592	2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeDebugPrivilege	3864	bab46a68
Token: SeTcbPrivilege	3864	bab46a68

C:\Users\Admin\AppData\Local\Temp\2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_be6def8b3e5c22ccd4be8668ca47b885_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592

C:\Windows\Syswow64\bab46a68
C:\Windows\Syswow64\bab46a68
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

422730

Path C:\Windows\422730
Size 506B
SHA256 f019437f5d9455fb9cea56e1548c15ab59100b2782809f1c47ea32a6f57b78b6
MD5 c479b4a15ee5bab31ac54af4bb8f1a3d
SHA1 9f0e6bb069be2f186934b80e6ba6601cf71ca9a9
SHA512 ec31a2aa0969c415f2fa7930a99a03d02b58aec24278cdbe366c3c94d9723543b9d5281d3448f5ef77d4d08301e8faa56aa1781497e922e3729a2dcd350933b2
TLSH
T125F00EB7DE681CD02AEB30B959436C853E1AC02B064310B2E4FD789100BFA0EDD43C1C
MD5 SHA1 SHA512 TLSH

Submit Download

bab46a68

Path C:\Windows\SysWOW64\bab46a68
Size 1.1MB
SHA256 d2a665b3debd21e16a40fab332d1e77d88dc70e6565a8403dcd1fea02ec61c94
MD5 06d73cddbbb5372d7621ed8150221de8
SHA1 526695a37eea886c309fc7dcebebf5679803e9b8
SHA512 dec524b722cfd62619541a377f21fcd0f7c0e9c89f5be4b2a3c53a28321a1dcb21f473837a17cf5a4e691e9036fba1984f73a4c989cb82afd6533b74c2924bd6
SSDEEP 24576:TvO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:THHKO29QGhuTtS0rQi
TLSH
T12B359E31E241C036D4A70176C6BA4BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-0-0x0000000000240000-0x00000000002A3000-memory.dmp

Download

memory/3864-4-0x0000000000A50000-0x0000000000AB3000-memory.dmp