Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 01:56
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe
- Size 4.0MB
- Sample260910-cczdascm9t
- SHA256 8873201c3e4645599d5f2f2b840c8b66f05ee5c5123eb508ef4e0ba0f011d909
- MD5 eb41b2f4d872d53a45f8cdc4018eabe3
- SHA1 387a5b30693750a7b5ed72b4956aa14d2d4ed68e
- SHA512 8b8971aa686f79e001af264cd1357f8936b4efe03c51df64970d5b649d1ab70865ef9032f943c26b203d1a1d2a2529f56a5a8ddbb19526b5f2dc24d91011f9f0
- SSDEEP 98304:6nKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:6CNDtojKL2Kqo7
- TLSH T12E16CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
resource yara_rule behavioral2/files/0x00090000000068e3-2.dat INDICATOR_EXE_Packed_VMProtect - UPX dump on OEP (original entry point) 1 IoCs
resource yara_rule behavioral2/files/0x00090000000068e3-2.dat UPX - Executes dropped EXE 1 IoCs
pid Process 4316 605605ca - Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 5 223.5.5.5 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 42 114.114.114.114 4316 605605ca Destination IP 43 223.5.5.5 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 55 114.114.114.114 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 56 223.5.5.5 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Destination IP 3 114.114.114.114 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 605605ca File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 605605ca File created C:\Windows\SysWOW64\605605ca 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\49e438 605605ca File opened for modification C:\Windows\60c3a8 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 605605ca - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 605605ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 605605ca Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 605605ca Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 605605ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 605605ca Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 605605ca Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 605605ca Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 605605ca Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 605605ca - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4316 605605ca 4316 605605ca 4316 605605ca 4316 605605ca 4316 605605ca 4316 605605ca 4316 605605ca 4316 605605ca 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Token: SeTcbPrivilege 5652 2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe Token: SeDebugPrivilege 4316 605605ca Token: SeTcbPrivilege 4316 605605ca
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_eb41b2f4d872d53a45f8cdc4018eabe3_amadey_coinminer_darkgate_elex_glassworm_graphican_kwamp.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5652
-
C:\Windows\Syswow64\605605caC:\Windows\Syswow64\605605ca1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\605605ca
- Size 4.0MB
- SHA256 00c54ddb13013761c6dd895580a063d9e5d06856fc233e25a6cf6f6b6d3f7634
- MD5 56ae95998278b14c55bfc39a9e21d45e
- SHA1 5a496ff0c0a3fa56cafec7b3054e2886660014f3
- SHA512 f074147d65991533adf468ac3829dbe3c7b66f201c562398f5f0713562a649cf209884cf9866403338dc2ff08de97cb1f2ac9fd8ad3da52a82598bbd6d88f63f
- SSDEEP 98304:bnKl2qOb2lP8ssYoJxKkyWsM0r1QnfKHV0Fe7:bCNDtojKL2Kqo7
- TLSH T1D116CF11F7A1C036C49701718D7A876EA678BD214B258AC7B3C47B6E5FB23D1AE3530A
- MD5 SHA1 SHA512 SSDEEP TLSH