Analysis
- max time kernel
149s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 22:29
General
- Target 2026-08-23_b5e4037a3bcdcf905c878f08408dd827_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_remcos_smoke-loader.exe
- Size 13.8MB
- Sample260825-2ejs3azcmb
- SHA256 eec9d89e39f35d9f9d26f8138a025ec88ed1c71d99193c7338cdb17228dd09f3
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_b5e4037a3bcdcf905c878f08408dd827_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b5e4037a3bcdcf905c878f08408dd827_amadey_coinminer_darkgate_elex_emotet_glassworm_icedid_remcos_smoke-loader.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RSCProject.dll
memory/3268-7-0x0000000073260000-0x000000007431B000-memory.dmp
memory/3268-16-0x00000000081A0000-0x0000000008200000-memory.dmp
memory/3268-15-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-14-0x0000000008340000-0x0000000008341000-memory.dmp
memory/3268-13-0x0000000008170000-0x0000000008171000-memory.dmp
memory/3268-12-0x0000000008180000-0x0000000008181000-memory.dmp
memory/3268-11-0x0000000008320000-0x0000000008321000-memory.dmp
memory/3268-10-0x0000000008150000-0x0000000008151000-memory.dmp
memory/3268-9-0x0000000008300000-0x0000000008301000-memory.dmp
memory/3268-8-0x0000000008190000-0x0000000008191000-memory.dmp
memory/3268-18-0x0000000008310000-0x0000000008311000-memory.dmp
memory/3268-17-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-24-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-23-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-22-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-21-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-20-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-19-0x00000000092A0000-0x00000000092A1000-memory.dmp
memory/3268-37-0x0000000009290000-0x0000000009291000-memory.dmp
memory/3268-36-0x00000000083E0000-0x00000000083E1000-memory.dmp
memory/3268-35-0x0000000008430000-0x0000000008431000-memory.dmp
memory/3268-34-0x0000000008440000-0x0000000008441000-memory.dmp
memory/3268-33-0x0000000008410000-0x0000000008411000-memory.dmp
memory/3268-32-0x0000000008460000-0x0000000008461000-memory.dmp
memory/3268-31-0x0000000008450000-0x0000000008451000-memory.dmp
memory/3268-30-0x00000000083F0000-0x00000000083F1000-memory.dmp
memory/3268-29-0x00000000083D0000-0x00000000083D1000-memory.dmp
memory/3268-28-0x0000000008380000-0x0000000008381000-memory.dmp
memory/3268-27-0x0000000008360000-0x0000000008361000-memory.dmp
memory/3268-26-0x00000000083B0000-0x00000000083B1000-memory.dmp
memory/3268-25-0x00000000083A0000-0x00000000083A1000-memory.dmp
memory/3268-39-0x00000000081A0000-0x0000000008200000-memory.dmp
memory/3268-40-0x0000000073260000-0x000000007431B000-memory.dmp
memory/3268-38-0x0000000073260000-0x000000007431B000-memory.dmp