Analysis
- max time kernel
108s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 12:26
Behavioral task
behavioral1
Sample
2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe
- Size 4.9MB
- Sample260816-pl98daxyay
- SHA256 8026cad316cd57bc1ca48a5fe62ddd39ec1c73cf1883eab2a823bd9041c4adc5
- MD5 f77504f4720a3fc0ede96b376c39b6ac
- SHA1 402eb574cc94942aa1ae271469dff023d7687d3e
- SHA512 db957fee857ae2ef5a902181319b4601c6c39c975c976ec4d342124e36857a5bc2e76078e3caa7d80a3183142f39ab1136777c8d1e0376d7d5c995dda017ba04
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBK:+stsF7IabjKoh9WyV2Vlx/hv7St0Og
- TLSH T19F368E217BE48035E1B756B1A9BA8366D9727C604B7186CF6390773E1F72BD05A32323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5048-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5048-9-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2904-16-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c46-36.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00420000000188c5-546.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d3e-1278.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f1-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-12.dat aspack_v212_v242 behavioral2/files/0x0003000000019c46-36.dat aspack_v212_v242 behavioral2/files/0x00420000000188c5-546.dat aspack_v212_v242 behavioral2/files/0x0004000000019d3e-1278.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2904 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5048 2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe 2904 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f77504f4720a3fc0ede96b376c39b6ac_amadey_coinminer_darkgate_elex_redline-stealer_rhadamant.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 8026cad316cd57bc1ca48a5fe62ddd39ec1c73cf1883eab2a823bd9041c4adc5
- MD5 f77504f4720a3fc0ede96b376c39b6ac
- SHA1 402eb574cc94942aa1ae271469dff023d7687d3e
- SHA512 db957fee857ae2ef5a902181319b4601c6c39c975c976ec4d342124e36857a5bc2e76078e3caa7d80a3183142f39ab1136777c8d1e0376d7d5c995dda017ba04
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBK:+stsF7IabjKoh9WyV2Vlx/hv7St0Og
- TLSH T19F368E217BE48035E1B756B1A9BA8366D9727C604B7186CF6390773E1F72BD05A32323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.4MB
- SHA256 a102aff4ac7c49bfce7a9c090ab271ca8d7c2b5274d6140e8011d8fc610b7711
- MD5 9c64928ef0a1bc465f9425819126ed84
- SHA1 b2968ca60fe4fc0cde3edf0b5b09aff431f53579
- SHA512 86ccbd61fa5191f40abbc19a5e6e4982f51fede667d9df73d03d00e4a89c0042c37b77b5fe92f09b84b5898eeaf41e45e4749c494cad833b853ac0084d34de8a
- SSDEEP 98304:+stsF7IabjKoh9WyV2Vlx/hv7St0Ogmjo:VmFlV2VnpvUuwo
- TLSH T1A9468D22BBF48135E0B795B5A9B69356D9727C604B7086CF5380773D2F72BD09A32322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$
- Size 5.6MB
- SHA256 e3a5b43b3c43c50c0a333e85a9efb55c3fb5246f9dfc926a11da538c103bdfdc
- MD5 4cec4d7e42c5eab42d184da5ec43e9c5
- SHA1 eccd289f80b2cf85665295527e4114960d4b69f6
- SHA512 ed2fb07fa8ea22c23506644e48352e43f597d9467071aedd3f5c53be04d7c337412a5364b1d270a448f05cbe5e408c1c07c879886d91d26aceade09df1386cb4
- SSDEEP 98304:+stsF7IabjKoh9WyV2Vlx/hv7St0OgL/h1+:VmFlV2VnpvUuL/h1+
- TLSH T1F2467D22BBF48135E0B791B5A9B69356D9727C604B7186CF5380773D2F72BD09A32322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
- Size 4.9MB
- SHA256 a5565bf6d4b9600be9f937f55536748972082af25a32c59fde3b053264211b49
- MD5 692e869d64e3baac0eda271023e1ae04
- SHA1 371168b51ed96e2efea918b88afa2557a57369a1
- SHA512 6fd2555fdeb19476075414bed5deb957ebb8430e272be955902b22d87d1c9e7f3126ce6bce580ebc279cad399d651b5e0aadd6e8ecbbfc9183909d8740c2fc0e
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTBr:+stsF7IabjKoh9WyV2Vlx/hv7St0OgA
- TLSH T1EF368E217BE48035E1B796B1A9BA8356D9727C604B7186CF6390773E1F72BD05A32323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 5.0MB
- SHA256 326d1eab51c43ba86819ea69a06373addfca13c6653bc2d7b6466c8bb295dc08
- MD5 791234de2ccb2fbf6621bb4f96275b4a
- SHA1 9df181cb17c1e302f9272cab412cecace8d5e471
- SHA512 bc62a05f9cbaf71862750d95e2d6648893f563aa0a46b3a9996c51b50c111149bc2a8c421b43ae037de8d76e23b7f413c9b766149b302d44a8a1737d214dbb00
- SSDEEP 49152:T2aDHXAWSytLoqUCInTUCIabjKoh9WEbtL2tLlZqhaK6zbfqdlIhKPgssSt2gTB3:+stsF7IabjKoh9WyV2Vlx/hv7St0Og4
- TLSH T140368D217BE48035E1B756B1A9BA8356D9727C604B7186CF63907B3E5F32BD05A32323
- MD5 SHA1 SHA512 SSDEEP TLSH