79123b8033b82ee920d3c671e7a617629c9ec032c33a50463cba3beb1b0f0956

Resubmissions

26/08/2026, 15:54

260826-tcfdvssake7

26/08/2026, 15:51

260826-tarzwafp7z10

Analysis

user interaction
yes
max time kernel
18s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Size 1.8MB
Sample260826-tcfdvssake
SHA256 79123b8033b82ee920d3c671e7a617629c9ec032c33a50463cba3beb1b0f0956
MD5 9c8fc546abc0672ca54dbb273330af92
SHA1 58cb54c8c27c614b8bb8b08a17d45dc13ad9cc5a
SHA512 316db7a9f5724b6b1add43d425ed18349d3175c89ec5088c55bd0dd50b562a8ff97f55b5f07b596b871d3cf55ab96fc3e9d151fe647b563b513526c85bdb533a
SSDEEP 49152:WHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4Qn:WnKdtWsM0r1QnxK4q
TLSH
T11785AE21B351C036D4AB01758ABA47AEA578BD21472551CBB3D47B7E1FB23D2AE3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4356	e2094c6e

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	4356	e2094c6e
Destination IP	4	223.5.5.5	4356	e2094c6e

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	e2094c6e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	e2094c6e
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	e2094c6e
File created	C:\Windows\SysWOW64\e2094c6e	2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	e2094c6e

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4a9388	e2094c6e

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2094c6e

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	e2094c6e
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	e2094c6e
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	e2094c6e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	e2094c6e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	e2094c6e
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	e2094c6e
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	e2094c6e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	e2094c6e
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	e2094c6e

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e
4356	e2094c6e

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeTcbPrivilege	3552	2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeDebugPrivilege	4356	e2094c6e
Token: SeTcbPrivilege	4356	e2094c6e

C:\Users\Admin\AppData\Local\Temp\2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_9c8fc546abc0672ca54dbb273330af92_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\Syswow64\e2094c6e
C:\Windows\Syswow64\e2094c6e
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e2094c6e

Path C:\Windows\SysWOW64\e2094c6e
Size 1.8MB
SHA256 a730ded867e3eea22f7f6b467cddf96b86c8e5310409c94e0a0d9ed2e8b42dc9
MD5 e4d857e1c184253ba1a82502113c3887
SHA1 4d5f9f229cad942084874e4dcb93ed79a2bb707d
SHA512 5915c183967a399cae7ab5eecdd45abe0947103d01c890dc648fa3f609f5e5616d08e23aaf9eeedba79b8dc61702825b981d316f4cb94e0b57a6aee935c77704
SSDEEP 49152:nHHKO29Qm5QZuTtS0rQMYOQ+q8CEKTG4Qn:nnKdtWsM0r1QnxK4q
TLSH
T11285AE21B351C036D4AB01758ABA47AEA578BD21472551CBB3D47B7E1FB23D2AE3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3552-0-0x0000000000A80000-0x0000000000AE3000-memory.dmp

Download

memory/4356-4-0x0000000000120000-0x0000000000183000-memory.dmp

Download