47810b669a0453bd5e0cfaad009842cdd46f61d135ce0ad385454fa96d388ab9

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Size 51.4MB
Sample260910-kgdamattcy
SHA256 47810b669a0453bd5e0cfaad009842cdd46f61d135ce0ad385454fa96d388ab9
MD5 fa37af915a557d310697a90180564c49
SHA1 1313fa09791845fa01f3994a0c2e55ec71b5cd30
SHA512 0f3f580cf5a0a289b5328bc2e0fb56e253424bb0c8ae0336cd294c8c2d1d010c2fc3be12bb65d8f916a239a62e56f9a093901033bf3b703b8d0fcbcda61464e0
SSDEEP 196608:2KWQc0gEYnvLuKWQc0gEYnvLuKWQc0gEYnvLBHh6ImzD+Fx:ncZEIvDcZEIvDcZEIvQu
TLSH
T1FAC77D08F98740B1D92B50B04DDBD2BF8630BA2187118DEBF78DCA6BA923FD16538755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
5888	svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe
4020	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACBCBBBCBCBAACCBBABBBCCACACBAAABBBBCBCAABCCABCABBCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe"	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBACBBBBAAABBCCBAAAABBCCABCACCBBACBCABCBBCBBACABCAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe"	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4528	sc.exe
4608	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5248	cmd.exe
2636	cmd.exe
3124	cmd.exe
5308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2348	schtasks.exe
5764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
5888	svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe
5888	svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Token: SeDebugPrivilege	952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
Token: SeDebugPrivilege	5888	svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2636	2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	91
PID 2636 wrote to memory of 2348	2636	cmd.exe	93
PID 952 wrote to memory of 3300	952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe	94
PID 2776 wrote to memory of 3124	2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	97
PID 3124 wrote to memory of 4528	3124	cmd.exe	99
PID 2776 wrote to memory of 5308	2776	2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	100
PID 5308 wrote to memory of 4608	5308	cmd.exe	102
PID 952 wrote to memory of 5248	952	svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe	104
PID 5248 wrote to memory of 5764	5248	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_fa37af915a557d310697a90180564c49_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACCCCBBCAAABACBABCBABBBCACBBCACABAAACCAABAACCCBBCBCCAAACABACCABBCABCAACCABCACABABCAAACACACCCABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBAACCCCBBCAAABACBABCBABBBCACBBCACABAAACCAABAACCCBBCBCCAAACABACCABBCABCAACCABCACABABCAAACACACCCABABBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe" start= auto displayName= "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe" start= auto displayName= "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACABCCABABAABAAABCCCBACACBABACABBBACBABCBBCCACABBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBCABBABCBBABBABAACCACCCCBBCBCCCCBACACCABCCAACACCCAAABABCABACAAACCBBACBCBCBCBCCABBACCBBCABBACBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABCBCBCABBABCBBABBABAACCACCCCBBCBCCCCBACACCABCCAACACCCAAABABCABACAAACCBBACBCBCBCBCCABBACCBBCABBACBACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBCBBBAACCCAACCCBACABBBBCCCBCACBCCBBCAACBAAABCABBBBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACACCCBCBBCABACABBBACBBCBBABAABACBAAABACCBBABBBCABCC.exe
1⤵
- Executes dropped EXE
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5fc6be1424b946953f034fd94a7d79fa7bb2c5a78fb70b298e8b9eefe98f6843
MD5 fb178fc8a88cebdafd9f7af9fbcbfde9
SHA1 7c40aee3be1fb8aca8160b8775a6905cd77920e7
SHA512 0ff23a37ffe175833d1a3a0d6191e1c1e954a40189ac25961c29175ec74ea42569acf0db909223950b02b3e5154673a2bb2ac765df9c034067abcc89b3e72210
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0ee21f26685acf35abfbe55fc2c1977dbaf3367c731b5ecf1f93779438d5273
MD5 0605b292dd9d01a30c077268705c6ac0
SHA1 f134ce4e02158da0e017c388c8fb46f5137d337f
SHA512 d712af1eae7a6d31510427f0bb6372b0869b4277764abb0b03b1c6b4c175c40ecc79a743a67c07d0228bce2f9585785046ba1515d88c6265278e7f08702ea483
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b4927101dfbe2839b174d45dc12d8ec00971af38d4249c7e920a2dce60d94d9
MD5 961052825a287e5f134f03382ceba43d
SHA1 921dbe176d85013b6e86460e52096e5c315ea13c
SHA512 19777748a31c26086eec0acefed9382340a42ba0c69ec5096429fc9d922224d065e4ef1efe812a822598ebd86a69f70aee2fff52c6f8a5277014c5bd80673b90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff3e424f329b5402cab13a481637bafa306890b56c97339714f966e41d520307
MD5 455037a7f1db234a7c352434005685c6
SHA1 1a220bd1606e8f06a9898d2b6e1dd4abb2516c91
SHA512 305be35bd1a6e9d8f5f8b1c6e3f5e7d0786110b24a29ae86d21f8ff5a496ff3b2b5cfbd1d42e5f9b685effd2faa9fd72dab4be1c95d98b3026e10d252aee5e4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a9fab912e889fcb4843c4d7c4d84fa22ce4fa02f43d2c7a72a7dd899bba201b
MD5 b604d4e76826c9569654ad28923678d4
SHA1 3c9208910969cca2d483487302f43580f0649610
SHA512 21a9a220498346ed8002c1646503517d0e1d9c81d3792e2ee18537c93ac0143bb8e679c54e1b6b31a22cdf372e823c7f4c39fa8defa9e1460ca7b448ae2282fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61e0a932f1b68011a7ff7277653df53949dc66645f1ebb83c30aa7d5b8846c76
MD5 61636e571ec4c751972720912f949853
SHA1 102d9345714e8817685eaa8f1576fd1bfa1a7f36
SHA512 0392274fdd8ba64dfc90f0e0c170310a70998b2e579fdedb749eb5273478e09d310e87bd280cb0733704fe20fb299c59dc4ff567b7bf0b6d99e57204cfdfc546
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2da706f869459afa4e0abf057f9e835e7c33a635d8769f6d2d1986ac07af4487
MD5 9ad666b61d938d55070a5bc60d019f86
SHA1 55de8a35b29903d8980772980c2ce5f4e0b3bdeb
SHA512 d8f788fe7404325f0579fe7d5b17002a8c836c7a2b02472a3c5ce238e7addc685355b6599ff05723fdfe80f6ef6836bbca2bb8cf7faefc1469b1e1463b159ca5
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d770cfdad2b0180908fc3c07b3f7a9672c6803d3f396fb8b6f035dcef16300c7
MD5 3a88418a59e82ce84c3200daca7aa308
SHA1 f33b24ed74a2266a7d5059add7f0df153df3f986
SHA512 e265eecd2c2986885080288aa0f138ded8780c2991f45f1932faa062e5cc322b708c66cabe60d6fe1a68eae5a96c8f951eb5ef787e662da1e64fe31581b11bc1
TLSH
T16D119140E0A594B3F032B887A7269B8B4C98379FAC5CEF5433084219EF95C36CD194E6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 ab8b0ea88801c816db1991ccf416f6f734b1f1b3bf4acdec088f0edcad43d03e
MD5 8752e3490fc7edda4b0431908d23d83c
SHA1 89fd8a47fc28ccfa669f5e559f8e0f290799f5ea
SHA512 94081626ac82880a81d5e2b5a45b9a8ab489bd56a040c6617e618170f49e27309b28117a3e0b781eb873a056fbec675e34bf01134383c51dd6dc975d88579ce3
TLSH
T147115E40F0A598B3F132A8C7A7269BDB4898379FAC5CEF5422098218EF95C37CD194E5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-33-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/2776-6-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/4020-73-0x0000000000440000-0x0000000000461000-memory.dmp

Download

memory/5888-67-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download

memory/5888-87-0x00000000001B0000-0x00000000001D1000-memory.dmp

Download