6c19bccfe939d8641ce87049bab6ba5020171647543b8d64b7a068d43e350060

General

Target
2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Size 53.1MB
Sample260910-rbq3vsx1hx
SHA256 6c19bccfe939d8641ce87049bab6ba5020171647543b8d64b7a068d43e350060
MD5 8bd268441e9245b5be90650918f5e226
SHA1 3502348756f2d479fbbb972c53bdcd3231c5914a
SHA512 307589d90ba77a780c09b76a053b67e373737dae73b248f65e4220bd5044a65fa26591d8f8bd82cec5bf259b259fa12d99f278576e1320bf0963b8d6316f3be6
SSDEEP 196608:0Hh6ImzD+FUHh6ImzD+FUHh6ImzD+FUHh6ImzD+FJFIF0wuz:7kkk6z
TLSH
T1DBC75B05FACB44B1E96751704CDBD3BF8630BA118732CEEBE6488B1BA923BD15835716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
3160	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBABCABCABCCBAABBBBBCBBCBBBBACBBBCABCAAABBBBCAABACCCCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe"	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4616	sc.exe
624	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1360	cmd.exe
4660	cmd.exe
892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
Token: SeDebugPrivilege	1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 1360	4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	106
PID 1360 wrote to memory of 1856	1360	cmd.exe	108
PID 4444 wrote to memory of 4660	4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	110
PID 4660 wrote to memory of 4616	4660	cmd.exe	112
PID 4444 wrote to memory of 892	4444	2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe	113
PID 892 wrote to memory of 624	892	cmd.exe	115
PID 1476 wrote to memory of 1108	1476	svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_8bd268441e9245b5be90650918f5e226_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hijack.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCABCBBABBCABCBBCBCCCCCCABBAAACCCBACCACCAAAAACBBBCCAACBCBBBCCABACAABCCCAABBAABCBBAAAAACBBABCCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABCABCBBABBCABCBBCBCCCCCCABBAAACCCBACCACCAAAAACBBBCCAACBCBBBCCABACAABCCCAABBAABCBBAAAAACBBABCCCCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe" start= auto displayName= "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe" start= auto displayName= "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAABCABAACBABBCBBAACAABBBCBBBACABBBBACCBCAAAACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:624

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBBABCCBABBACCCCABCCABACBCBABCABACABABCBBBABCCABABAC.exe
1⤵
- Executes dropped EXE
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9a49feba13794d8834858b9ac3f94756c42e97e26069257932c028db683daad3
MD5 8da40d402ada77413df36081a85b2b36
SHA1 1c59d443e62b98d45e199054929a66dcff57868c
SHA512 0a471d8ca97a64fde2b671ac75799833c093faa157f0759cf41f156df63597202b6b6162dadb1a5b16668dabd931fec52ff7fe96ce1d4dcf1a77d0d3e72e82ee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b528cf642ac74712517afe0e804c4cf8965d9db071cc68fbe8dafe508b756e6f
MD5 b1842652d583f3db0b981c405bcf619b
SHA1 bf5fe20cc5d982f935c0d896bdd21f7565193740
SHA512 01f943a36ece970114c4e0b68e51cc7096bbaec8f787a8e04ee9ea82952d68a473150c679c97622680939e5215bfced1aff39f2b20fb119d19f08a3161b7c2a6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85549de8013b381b8e5ca32440fb2c821a8c3d5a0e008d1bd8bf45595c6e7538
MD5 f8e494158f68df465d4aa1c5273c7d23
SHA1 f6e96560b36439c0f72a366463c1ba6fe00569db
SHA512 9a2ea251dc6b43d5f3a95db4c5218b62aab578541721d77a6cc4cc2278eb3094399758643d4e822a080220c86c94391855b77993204562b9b5bd0e15a517ed39
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 778d8f34478dd20fea7210d92dd08b6d6382b3baf5f38226392ebaa5a2313d08
MD5 b5b273dccf2ce3f1b99117e16f2bdbbb
SHA1 3e5e1ab85064f55f03e3d1b94dfee9a2c614ee31
SHA512 1e2c1eb1948f39c6f891265808fab06dd1730db2dea84514f7b427d1f8d2e2e535931a0d0d9b8335df7a28674f91ae03832f416b9796a041298e12d416bfd16e
MD5 SHA1 SHA512

Submit Download

memory/1476-27-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/1476-40-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/4444-0-0x0000000000140000-0x0000000000161000-memory.dmp

Download

memory/4444-8-0x0000000000140000-0x0000000000161000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads