Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 21:09
General
- Target 2026-08-20_e4d29ad0704c5e02d389d3fccef359db_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe
- Size 5.2MB
- Sample260820-zzptpsyvgv
- SHA256 a7a3591258756996e1e0a2a8dd1722cd8d5f741c0ce5492dba1eebc0e52dfa32
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e4d29ad0704c5e02d389d3fccef359db_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e4d29ad0704c5e02d389d3fccef359db_amadey_coinminer_darkgate_elex_glassworm_hijackloader_lu.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 5482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 800 -ip 8001⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-0-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-4-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-1-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-6-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-16-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-11-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-7-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-9-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-23-0x00000000FF030000-0x00000000FF031000-memory.dmp
memory/800-602-0x0000000077778000-0x0000000077779000-memory.dmp
memory/800-631-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/800-637-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/800-647-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/800-665-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/800-686-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/800-685-0x0000000002F30000-0x0000000002F31000-memory.dmp
memory/800-740-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-684-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/800-683-0x0000000002F20000-0x0000000002F21000-memory.dmp
memory/800-682-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/800-681-0x0000000002F10000-0x0000000002F11000-memory.dmp
memory/800-680-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/800-679-0x0000000002F00000-0x0000000002F01000-memory.dmp
memory/800-769-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-781-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-678-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/800-677-0x0000000002EF0000-0x0000000002EF1000-memory.dmp
memory/800-815-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-676-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/800-849-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-675-0x0000000002EE0000-0x0000000002EE1000-memory.dmp
memory/800-674-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/800-673-0x0000000002ED0000-0x0000000002ED1000-memory.dmp
memory/800-672-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/800-671-0x0000000002EC0000-0x0000000002EC1000-memory.dmp
memory/800-670-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/800-669-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/800-668-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/800-667-0x0000000002EA0000-0x0000000002EA1000-memory.dmp
memory/800-666-0x0000000002E90000-0x0000000002E91000-memory.dmp
memory/800-664-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/800-663-0x0000000002E80000-0x0000000002E81000-memory.dmp
memory/800-662-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/800-661-0x0000000002E70000-0x0000000002E71000-memory.dmp
memory/800-660-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/800-659-0x0000000002E60000-0x0000000002E61000-memory.dmp
memory/800-658-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/800-657-0x0000000002E50000-0x0000000002E51000-memory.dmp
memory/800-656-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/800-655-0x0000000002E40000-0x0000000002E41000-memory.dmp
memory/800-654-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/800-653-0x0000000002E30000-0x0000000002E31000-memory.dmp
memory/800-652-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/800-651-0x0000000002E20000-0x0000000002E21000-memory.dmp
memory/800-650-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/800-649-0x0000000002E10000-0x0000000002E11000-memory.dmp
memory/800-648-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/800-646-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/800-645-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/800-644-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/800-643-0x0000000002CD0000-0x0000000002CD1000-memory.dmp
memory/800-642-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/800-641-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/800-640-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/800-639-0x0000000002CB0000-0x0000000002CB1000-memory.dmp
memory/800-638-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/800-636-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/800-891-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-635-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/800-633-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/800-632-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/800-626-0x00000000FF1D0000-0x00000000FF1D5000-memory.dmp
memory/800-937-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-992-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-1046-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-1047-0x0000000002B70000-0x0000000002C6D000-memory.dmp
memory/800-3345-0x0000000002B70000-0x0000000002C6D000-memory.dmp