c3fa982518a5bb466dc8aa423a2d96ba11b127e139a025c664ebe2f97c5d1c1f

General

Target
2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Size 1.1MB
Sample260910-jgr84ssxht
SHA256 c3fa982518a5bb466dc8aa423a2d96ba11b127e139a025c664ebe2f97c5d1c1f
MD5 0bc709ab8ce7bcb31a23b3be16cf17a9
SHA1 25dae3ddc698f94b94c32f0fa06fc2b67c32bc91
SHA512 bf38d870ab27d8a75ad755af87d74123eb80c266766bffdd23b5a579835c6a705346f39091b4fffe6eb0e8f38023d9aac94b98d46c39cc84730911ca1c0d21ab
SSDEEP 24576:yvO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:yHHKO29QGhuTtS0rQi
TLSH
T1F8359E31E241C036D4A70176C6BA4BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4452	cd2dcc97

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	4	114.114.114.114	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	6	223.5.5.5	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	39	114.114.114.114	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Destination IP	40	223.5.5.5	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	cd2dcc97
File created	C:\Windows\SysWOW64\cd2dcc97	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3EC845F33427F1C99AF855BE8930371C	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3EC845F33427F1C99AF855BE8930371C	cd2dcc97
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	cd2dcc97

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4c3848	cd2dcc97
File opened for modification	C:\Windows\381618	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cd2dcc97
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cd2dcc97
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cd2dcc97
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cd2dcc97
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cd2dcc97
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cd2dcc97
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cd2dcc97
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cd2dcc97
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cd2dcc97
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cd2dcc97

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
4452	cd2dcc97
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeTcbPrivilege	3276	2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
Token: SeDebugPrivilege	4452	cd2dcc97
Token: SeTcbPrivilege	4452	cd2dcc97

C:\Users\Admin\AppData\Local\Temp\2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_0bc709ab8ce7bcb31a23b3be16cf17a9_amadey_coinminer_elex_glassworm_graphican_kwampirs_mafia.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3276

C:\Windows\Syswow64\cd2dcc97
C:\Windows\Syswow64\cd2dcc97
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cd2dcc97

Path C:\Windows\SysWOW64\cd2dcc97
Size 1.1MB
SHA256 0c9d3c98bbf95f1b3d7c7399abbf2971d3f5a2fa371ccf63c2f23ddf8ead1f12
MD5 7096fc3f53c5e1db5f7709222e0aae39
SHA1 ba3e2b14b777fb0d5770b281c239c65269aada30
SHA512 e1fef95ec07d3f90d89bc4533abfe50feb29ec0af7dc288335a705f22eb20aac788c66fc96013699db7d3734ef1ce99ac89c3d474e7e1a8f078f6fad5a325b14
SSDEEP 24576:UvO2xJKRI2FOkx2LFEvhuZ98Es8k3OH3C0rQ6+y:UHHKO29QGhuTtS0rQi
TLSH
T11C359E31E241C036D4A70176C6BA4BBFA5787D22172555CBE3D43E6A2F722D2AE3170E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-0-0x0000000000B20000-0x0000000000B83000-memory.dmp

Download

memory/4452-4-0x0000000000C30000-0x0000000000C93000-memory.dmp