a4004348ba9a1f51e8a81d18472d79cb548176cd0550b5c69550914f8f6df4ac

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_433c15e6b9f7845878055207770f3474_amadey_coinminer_darkgate_elex_glassworm_lightspy_luca-s.exe
Size 4.5MB
Sample260831-pd4evstxft
SHA256 a4004348ba9a1f51e8a81d18472d79cb548176cd0550b5c69550914f8f6df4ac
MD5 433c15e6b9f7845878055207770f3474
SHA1 fa005bf0e3134a02e21fc72deb0a037e7d54a64c
SHA512 d7b68feda26ab5783dc626d8a099be1ce0f7f757c824ab5f5d95624cc91c6cb73e6d8877d6760f50c3952f2add2bacd3620b5e96886c0f383b195fe9695b462a
SSDEEP 98304:uhHj4vJdgE0hilnq6gj/LpsU7wcsiHRwYaV/CG1f:uQJ0i0jVs8Rw7VKaf
TLSH
T1A226BE61BB82C4B2D99201F855AEA77F083CAE384B74D4C397D41DBE49705C36A3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-30_433c15e6b9f7845878055207770f3474_amadey_coinminer_darkgate_elex_glassworm_lightspy_luca-s.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_433c15e6b9f7845878055207770f3474_amadey_coinminer_darkgate_elex_glassworm_lightspy_luca-s.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-30_433c15e6b9f7845878055207770f3474_amadey_coinminer_darkgate_elex_glassworm_lightspy_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_433c15e6b9f7845878055207770f3474_amadey_coinminer_darkgate_elex_glassworm_lightspy_luca-s.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads