fb30390b2db7a8b1dc60cd450f8f471aa0071664861dea592ee4d91f8ccb6f35

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
Size 14.4MB
Sample260827-bvntvaydnc
SHA256 fb30390b2db7a8b1dc60cd450f8f471aa0071664861dea592ee4d91f8ccb6f35
MD5 f87d09ff1d699565e21761a7d4ae6ce8
SHA1 ec1f7e2473d9af1b5e481d0c5bb70338aaabf424
SHA512 540f23a6cc790575e23e37060e09c785fee8e092e5131a36777c41c6764c1cddfe25927022c220234a5baf2e1be828f4b571ead38c06afb9894ce7ab83c0e3bc
SSDEEP 196608:WWIywrbZcSFpUD6o93iBVhaQXGqtw+gxCHcEWJ7+AkZnXI1NmECL2fGwyNA28IJG:tFwnBgDdiBfEScEW1oPcr86
TLSH
T19EE67C11E7D74274FE731A309976A22E463FBD614AB1CD4FD28C294D5BB39818821B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery execution spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2684	files.dat
2968	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5676	cmd.exe
4964	cmd.exe
6080	cmd.exe
3460	cmd.exe
4400	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2352	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4336	WMIC.exe
4336	WMIC.exe
4336	WMIC.exe
4336	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe
4116	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4336	WMIC.exe
Token: SeSecurityPrivilege	4336	WMIC.exe
Token: SeTakeOwnershipPrivilege	4336	WMIC.exe
Token: SeLoadDriverPrivilege	4336	WMIC.exe
Token: SeSystemProfilePrivilege	4336	WMIC.exe
Token: SeSystemtimePrivilege	4336	WMIC.exe
Token: SeProfSingleProcessPrivilege	4336	WMIC.exe
Token: SeIncBasePriorityPrivilege	4336	WMIC.exe
Token: SeCreatePagefilePrivilege	4336	WMIC.exe
Token: SeBackupPrivilege	4336	WMIC.exe
Token: SeRestorePrivilege	4336	WMIC.exe
Token: SeShutdownPrivilege	4336	WMIC.exe
Token: SeDebugPrivilege	4336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4336	WMIC.exe
Token: SeRemoteShutdownPrivilege	4336	WMIC.exe
Token: SeUndockPrivilege	4336	WMIC.exe
Token: SeManageVolumePrivilege	4336	WMIC.exe
Token: 33	4336	WMIC.exe
Token: 34	4336	WMIC.exe
Token: 35	4336	WMIC.exe
Token: 36	4336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4336	WMIC.exe
Token: SeSecurityPrivilege	4336	WMIC.exe
Token: SeTakeOwnershipPrivilege	4336	WMIC.exe
Token: SeLoadDriverPrivilege	4336	WMIC.exe
Token: SeSystemProfilePrivilege	4336	WMIC.exe
Token: SeSystemtimePrivilege	4336	WMIC.exe
Token: SeProfSingleProcessPrivilege	4336	WMIC.exe
Token: SeIncBasePriorityPrivilege	4336	WMIC.exe
Token: SeCreatePagefilePrivilege	4336	WMIC.exe
Token: SeBackupPrivilege	4336	WMIC.exe
Token: SeRestorePrivilege	4336	WMIC.exe
Token: SeShutdownPrivilege	4336	WMIC.exe
Token: SeDebugPrivilege	4336	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4336	WMIC.exe
Token: SeRemoteShutdownPrivilege	4336	WMIC.exe
Token: SeUndockPrivilege	4336	WMIC.exe
Token: SeManageVolumePrivilege	4336	WMIC.exe
Token: 33	4336	WMIC.exe
Token: 34	4336	WMIC.exe
Token: 35	4336	WMIC.exe
Token: 36	4336	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4116	WMIC.exe
Token: SeSecurityPrivilege	4116	WMIC.exe
Token: SeTakeOwnershipPrivilege	4116	WMIC.exe
Token: SeLoadDriverPrivilege	4116	WMIC.exe
Token: SeSystemProfilePrivilege	4116	WMIC.exe
Token: SeSystemtimePrivilege	4116	WMIC.exe
Token: SeProfSingleProcessPrivilege	4116	WMIC.exe
Token: SeIncBasePriorityPrivilege	4116	WMIC.exe
Token: SeCreatePagefilePrivilege	4116	WMIC.exe
Token: SeBackupPrivilege	4116	WMIC.exe
Token: SeRestorePrivilege	4116	WMIC.exe
Token: SeShutdownPrivilege	4116	WMIC.exe
Token: SeDebugPrivilege	4116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4116	WMIC.exe
Token: SeRemoteShutdownPrivilege	4116	WMIC.exe
Token: SeUndockPrivilege	4116	WMIC.exe
Token: SeManageVolumePrivilege	4116	WMIC.exe
Token: 33	4116	WMIC.exe
Token: 34	4116	WMIC.exe
Token: 35	4116	WMIC.exe
Token: 36	4116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4116	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
2968	setup.exe
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE
2352	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 3460	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	89
PID 3460 wrote to memory of 4336	3460	cmd.exe	91
PID 1296 wrote to memory of 4400	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	93
PID 1296 wrote to memory of 5676	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	95
PID 1296 wrote to memory of 4964	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	97
PID 5676 wrote to memory of 4116	5676	cmd.exe	99
PID 4964 wrote to memory of 2684	4964	cmd.exe	100
PID 1296 wrote to memory of 6080	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	101
PID 1296 wrote to memory of 2352	1296	2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe	103
PID 6080 wrote to memory of 2968	6080	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3460
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-08-26_f87d09ff1d699565e21761a7d4ae6ce8_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c copy C:\Windows\system32\Tasks\OInstall "C:\Windows\Temp\OInstall.tmp" /Y
  2⤵
  - Executes a command shell one-liner
  PID:4400
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2684
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c C:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Users\Admin\AppData\Local\Temp\files\setup.exe
    C:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2968
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

v32_16.0.20326.20112.cab

Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32_16.0.20326.20112.cab
Size 11KB
SHA256 ed2ef2b1f258abb042cc3d290c7b162d0d38591ca4df0d33e5e68171c9b2d9af
MD5 9f2d1bce82fdbd68a0631c7ad4c81626
SHA1 328741bdd92b83b73b360c396353e94a355c9f69
SHA512 1086e28c6d8f1c718fe1dc19cf07ef128e8c321e81760ed40c59b067ba298f89a521736b1c449c112ccd0583896a98803acd2ae0999cc1ff74f26b2a795d47c2
SSDEEP 192:p56G/rGxbARNHkca8LxyQxh4FYqwNTQdnulc/9X01k9z3A16pxPc0pK8:X6yGRArHkcaGAEh4FYVNT0uO9R9za6pb
TLSH
T195426DD28A2C9043EDCBBD60E2A4ED933C7C83C71E44A45A51D2F5991DE33C9DB6906C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VersionDescriptor.xml

Path C:\Users\Admin\AppData\Local\Temp\OfficeC2R706685D1-9743-40E2-9087-6424A0FE5D6D\VersionDescriptor.xml
Size 25KB
SHA256 9af84b75451af6bf5c8de2fa80ef2954a6b44a5ba2fc6d0cc200cf4935adb8ca
MD5 e1dd1a32df6b6dc49b54fb19a3b4c5ef
SHA1 0b986861c967634a845eb15254e90963a4a884c2
SHA512 8ddabbb31575ee2df565455d0a8240ed844129113669968cd4c128457cd40c1eace194a10de03aef694f3189be44e4b8a7eb82d63cd322447b6edd2cb8088ba7
SSDEEP 96:CBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJVnOX:G/rZ73
TLSH
T164C2456BB8D03D1D413477A7E96336E2EF62826396050458F10D738B3FB285DB3AB619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
Size 502B
SHA256 5dd6a2cbaf3fe54e623ae8ca79cf3b4bd15871c2ea68a3ce669a854238fd1223
MD5 057b592b8166e85054f04a76633be4b9
SHA1 bccbf3660857aacd72fe7925800804ee10f728c2
SHA512 41bd363e55d4e1532d961b39fa1771a6537aed57dca95a3befe5d006bf79d0ec1d1ead376f721b9c8a49fa0c86a457583690f5158af31fe4aa6735aafd4969c3
TLSH
T13AF08290EA9C2D856731513991CA6B85FD6622634D212D08B18FA64B8BFB838334701F
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 707KB
SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
TLSH
T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 5.4MB
SHA256 1542ed413c1d21ca7b5cde39ce4e0d4ee592de26a25a9868ece77b875a16639e
MD5 64b22215cca284010e9bf96eb5ae2f02
SHA1 65ca0d5558f8461efe3cb70bda1949bb78a2a811
SHA512 9951f9e4817cf1fe7c53cc92acd7ac4d0d7621109ab9b204136523d21514a7964d2ecf89f13e3e6d881654e5e1b44606e70ab020125d2be2e2989dbecbb9fd39
SSDEEP 98304:zGrSU2RFMu6kpUDAdbsWo93oTBVh/y3AXGqtw+/ok8LXKpHcYBwY2h/wI:zcSFpUD6o93iBVhaQXGqtw+gxCHcEWF
TLSH
T127464921E7D74736FFB617706D79A659446DBDF10AF1CC0F62840E4D1AB0A82A920B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-0-0x0000000001254000-0x0000000001255000-memory.dmp

Download

memory/2352-22-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2352-29-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2352-26-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2352-31-0x00007FFCA5580000-0x00007FFCA5590000-memory.dmp

Download

memory/2352-32-0x00007FFCA5580000-0x00007FFCA5590000-memory.dmp

Download

memory/2352-23-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download

memory/2352-24-0x00007FFCA8180000-0x00007FFCA8190000-memory.dmp

Download