486c61d6fa45b5aaa5ba82b5db7a0c4807911557166be903a1b470944edf4598

General

Target
2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Size 3.0MB
Sample260908-1tel8ax1cs
SHA256 486c61d6fa45b5aaa5ba82b5db7a0c4807911557166be903a1b470944edf4598
MD5 82fa6c5647a7402c5b969bbab1853074
SHA1 7377fb2e59ea9969953495b2db00a8534f7f5706
SHA512 d3133b75bb36cfca632807a93c2a33b75c0db521890c46ad2b090ce7d40c21063db7636296102d0b685c3c8160e7e42945dd52146d9ef5d6b2a6ab82db3a9560
SSDEEP 49152:SHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:SnKdBWsM0r1Qn1K4XKH40Feq
TLSH
T119E59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000245fb-2.dat	UPX

Executes dropped EXE 1 IoCs

pid	Process
1156	487d1d0

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	4	223.5.5.5	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	30	114.114.114.114	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Destination IP	31	223.5.5.5	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	487d1d0
File created	C:\Windows\SysWOW64\487d1d0	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	487d1d0
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	487d1d0

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\13ca88	487d1d0
File opened for modification	C:\Windows\13b900	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	487d1d0
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	487d1d0
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	487d1d0
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	487d1d0
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	487d1d0
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	487d1d0
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	487d1d0
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	487d1d0
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	487d1d0
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	487d1d0

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1156	487d1d0
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeTcbPrivilege	1152	2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Token: SeDebugPrivilege	1156	487d1d0
Token: SeTcbPrivilege	1156	487d1d0

C:\Users\Admin\AppData\Local\Temp\2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_82fa6c5647a7402c5b969bbab1853074_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\Syswow64\487d1d0
C:\Windows\Syswow64\487d1d0
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13ca88

Path C:\Windows\13ca88
Size 490B
SHA256 dfb8206e67d7b9976dac8097c5063e119476af13f71ab20baa58bf25956df9bc
MD5 7967815c29a7368e830773beb219ee22
SHA1 195c172ca3ae9b2c18781569283bf7381976fe80
SHA512 bcebcf4c411c08971e22bf7cdcc164a6cefdc579c31165c8df13fa5488e9fe95eb088828f12695db06947f8ee939c529b2ceb28a7fe83f047379210e8a2a97b4
TLSH
T190F0D4F3F843B79607CB25B2BE03568C55A0B02E866164F5BED032E102E625F640741E
MD5 SHA1 SHA512 TLSH

Submit Download

487d1d0

Path C:\Windows\SysWOW64\487d1d0
Size 3.0MB
SHA256 7c7c0de7e7f8324634582eecea8bc1108de681f0810cd7cac64ea19443ad4b6c
MD5 9309199c41ca44c2ef8ef39835025cf2
SHA1 ee0862ddf0217a10fbbf27d3414e8abdb7fa8ed3
SHA512 d8de462405eff8c81e8e68a18756afd6a1369ab746155c44c95f5f290b677be3ce83b21e2dbf01b2374bd447ad6a05aa2073e8787fd8af2c509ecf2366f4c2b4
SSDEEP 49152:nHHKO29QG5QZuTtS0rQMYOQ+q8CEOTG4QmTGHQv9KFeMz:nnKdBWsM0r1Qn1K4XKH40Feq
TLSH
T1B1E59D12F7A0C036C4A7027589BA476EA678BD614B2547CBB3C47B2E5F723D16E3530A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-0-0x0000000000B10000-0x0000000000B73000-memory.dmp

Download

memory/1156-4-0x00000000003D0000-0x0000000000433000-memory.dmp