15a93625159858f154cd05f59e3a35454c3e4a2dc5cf33266c97fe0888152dd4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Size 56.8MB
Sample260910-nj7h2awsfw
SHA256 15a93625159858f154cd05f59e3a35454c3e4a2dc5cf33266c97fe0888152dd4
MD5 ba08ebe1ca87140565b390344e898d44
SHA1 b83a9ae440d2df779fe32a5309d3b0dc6f471086
SHA512 3b2fb9e9837ae6949937bc624ebfdd1ff46b15248d062db24cc57a8e7431a96dedfcb3176633a201777267e29bddfb1f5171aca102b745b5afb87ce29cbb2f0b
SSDEEP 196608:hHh6ImzD+FBHh6ImzD+FBHh6ImzD+FJFIF0wuL:c116L
TLSH
T1E3D74C05F98740B1E92B11B04CDBD3BF8A30BB15C7228EF7F64D8B5BA923B915835256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
2120	svchost_CCCBBBBBCAACAACCCBCCBCACCCABCCCCBACACBBBCAACBABBCCCCCCC.exe
3744	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCCACCACBBABCABCAACCBBABAABBBCCBBBAAABACAAABBBBBBBCBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe"	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAACCAACACBCCBBBCBCACABBCBAABBBBCACCAACABCBCACABCACBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBBBBBCAACAACCCBCCBCACCCABCCCCBACACBBBCAACBABBCCCCCCC.exe"	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2960	sc.exe
1072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4072	cmd.exe
764	cmd.exe
2396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBBBBBCAACAACCCBCCBCACCCABCCCCBACACBBBCAACBABBCCCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Token: SeDebugPrivilege	4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4072	5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	102
PID 4072 wrote to memory of 3868	4072	cmd.exe	104
PID 4780 wrote to memory of 2412	4780	svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe	109
PID 2412 wrote to memory of 3504	2412	notepad.exe	110
PID 5024 wrote to memory of 764	5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	114
PID 764 wrote to memory of 2960	764	cmd.exe	116
PID 5024 wrote to memory of 2396	5024	2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	117
PID 2396 wrote to memory of 1072	2396	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ba08ebe1ca87140565b390344e898d44_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCCBBCCCBCBAACABBBCABBBCBBCCAACCBABCBBBBCACBABABAABCBCCCCCACAABAABBAAAACBCCBABBAABCBCACBBCBACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCCBBCCCBCBAACABBBCABBBCBBCCAACCBABCBBBBCACBABABAABCBCCCCCACAABAABBAAAACBCCBABBAABCBCACBBCBACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe" start= auto displayName= "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe" start= auto displayName= "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCBBBAACBABABCBBBABAACBACBCACCAAABBCABCCCACACCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCAACAACCCBCCBCACCCABCCCCBACACBBBCAACBABBCCCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBBBBBCAACAACCCBCCBCACCCABCCCCBACACBBBCAACBABBCCCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBBBBABCBBCABABBCBBCAACACACCAABBAAABABBCACCAACBCCCC.exe
1⤵
- Executes dropped EXE
PID:3744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 83fcdfbacc36e4639b745bc98a73124790ca486494f88db780bcd2eba2d26f86
MD5 0da87e148de79a2104dd41909098964b
SHA1 38146e55cb1cbe6b0dd6176eb35a29eb16679aaf
SHA512 29140fbc4ce4943ce4d0070d283556814129c01a0d1a0a43f6cb11484b27f252b3a652c9dedd8a2e2131656563212954278aedea53e4d0d30a55bde0bde58566
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 16deefe0ebbd69af83d94bbba8285bcb036a2d75e7ef614daa9058f8f0c05ec7
MD5 1a2ba67a59ef9d7d2bab3768f8e0f84f
SHA1 7debc8b1d6b32cf3d3be7b885108cfa117deef09
SHA512 cf5c131427ade7d61cc643d7585590e3b6319b9fe77a4142c76854c4a70007de37fa3fb1def711684075766da4c34e7898d3561f5413325f0e6baafc7958f627
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8167779ffdb1d7721a9f8ab224add9addc6213bf8f84c3e1d98399d4865ad79
MD5 f2d5e1c413eb7d2954b83297b49b6118
SHA1 4e51fc1b5bef874b4d622a25a39cb677a7476c0d
SHA512 dd58f6383023ddc9b262b35458bc77e50268a270a203a286f091e842df7b1f9d8851bf078c55dee998953b4067458f2c9f963c541e6bee77ce2c085499e8fee6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1d134eb8bac8715f8ce42342b230add7f4cfcad28807c9b5516594a30fb8bd29
MD5 5529a2d128e468cad1cf55bdd058fb88
SHA1 be95f16d9c5ffc270cb7e94cf4372eb876fc8e6b
SHA512 1aee32d52d76f561bce19a085c33ee39b32157276fdae4dca59038c75b7691daeb78e49d89c072b001d88508889c0845ab2c94ba646a5a24ccdea40af5183270
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a3496f944a367d19e6b9d7717d56918d6ec21aa8fed97582b6d04b330a877fb5
MD5 db1fdbec7131563e29b8b5a174d336e1
SHA1 5720b37b1ef500ca1672a4b9d8b95b43bde4b876
SHA512 0b97da81b3a4d0d29f0072cca0b179dbfdaf5fd0c3beca5e5c9583993d15d75ee9db3d95d9c95d67777e096a2c3547d972c4d5094b0a7fe155189a80558bcdd0
MD5 SHA1 SHA512

Submit Download

memory/2120-78-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/2412-59-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/4780-27-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/4780-37-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/5024-0-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/5024-8-0x00000000001F0000-0x0000000000211000-memory.dmp

Download