175b9a643c394124ddb742760d3709755303073be21e6fc93f2e3d28ccfac10c

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Size 59.5MB
Sample260910-tqbb3avse1
SHA256 175b9a643c394124ddb742760d3709755303073be21e6fc93f2e3d28ccfac10c
MD5 60e368f0880dbf8c8fcec99dc6144ec0
SHA1 eb18abdf2a302e34fad30837469051de42d7b4bb
SHA512 c8c8ddb6577ba6cb786b7a795ecabc2fd9a569efff722ad97e639862ee545d33273f9335aad20437b3e9ab8d17a90af09dcd4a496cc8ec80be39b98416697a49
SSDEEP 196608:UHh6ImzD+F0Hh6ImzD+F0Hh6ImzD+F0Hh6ImzD+FUKWQc0gEYnvLY:bOOO+cZEIvE
TLSH
T185D76C05F98750B1D91B50B00DCBE3BF8630BB15C7228EE7EB8C8B5BE923BE16525255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
3864	svchost_CABBBBBABACACAACBBCBCACCBCCAAAABCBABBCAAACCAABBCCAAAAAB.exe
1480	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCBAACAACCBCBBBBCACBAACCBCABBBCBBBCBBBBCBBABAABBBBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe"	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCABCCAACCCACCCBBABAABCAABBCABBACABCBCBACACCCBCABCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBBBABACACAACBBCBCACCBCCAAAABCBABBCAAACCAABBCCAAAAAB.exe"	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4360	sc.exe
3784	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4232	cmd.exe
1328	cmd.exe
2124	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBBBABACACAACBBCBCACCBCCAAAABCBABBCAAACCAABBCCAAAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
Token: SeDebugPrivilege	5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 1328	3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	92
PID 1328 wrote to memory of 2780	1328	cmd.exe	94
PID 5832 wrote to memory of 5056	5832	svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe	95
PID 3088 wrote to memory of 2124	3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	98
PID 2124 wrote to memory of 4360	2124	cmd.exe	100
PID 3088 wrote to memory of 4232	3088	2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe	101
PID 4232 wrote to memory of 3784	4232	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_60e368f0880dbf8c8fcec99dc6144ec0_amadey_coinminer_cryptbot_darkgate_elex_glassworm_hellok.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBAAAAABABABACBACABAAABBCBBBACBCABBBCACBBABBCACCACCBAACBBCCBABCBABBBAAABCBBCBBCCBCCCACBABCABCCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCBAAAAABABABACBACABAAABBCBBBACBCABBBCACBBABBCACCACCBAACBBCCBABCBABBBAAABCBBCBBCCBCCCACBABCABCCCBACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe" start= auto displayName= "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe" start= auto displayName= "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABBAABCCABBBBCCACBACBCBBAACBCBBCBBCAABBACBACABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3784

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBABACACAACBBCBCACCBCCAAAABCBABBCAAACCAABBCCAAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBBBABACACAACBBCBCACCBCCAAAABCBABBCAAACCAABBCCAAAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAAACBBBACBAABBACCBCCCAABBBCACBCABCAABBABAACCCCAACBCA.exe
1⤵
- Executes dropped EXE
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fecf7fce7606c6a3be40c516056de0bb1073fd008e1ed271eb3e167e62263d95
MD5 50d0e322c4f065b44706a3d2bc495c0f
SHA1 1f8d0b5e8fad2b098364e79cd1106f1a9c379cee
SHA512 71bbc4876b2d54bf86e60e5a43baa69dad264aee5cf11bbd9f230db2849bcba2d320415164b1379a7ea9da21f04c6716d2fc0dad2dc9919b7b6722d1239b459b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3ab96bd0b2a132816a6862b4497227e2f4eccb6230efc3c4a591ac96c0102b2
MD5 80bab50c149bbb9408aface5ca90d625
SHA1 2fe95f5cebce05cfbd58e3f7fc8bb31ffb8b98cc
SHA512 786ffdacea6c51ce655013daf9523f4ba0fd542e8c43c7e6c17ab253b549a039a98c4ccb9f475762c10526088cf50b47ebc54ba89d187477c3b9834e517a4f7d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f0a671b6df4b73116e92d69ffae6048a16104dd14b6ce49fb3a91108b063b8b5
MD5 9b7a2fcb8165b337425ddb2cceaa00c2
SHA1 2ec6664453a41815175c4896bf467a2ea4984942
SHA512 fce37955917cf6858acef3965f44cf419ca10939254276f943eb836fa2f0ddcf6cdae163d541bda8102ad9c29a257dc65fca5f35b82de94903ebdce32b3cbdd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60a4b03cf79c2c322e60748ccd8f3b835f79e88fed6586a5a1eb5b1d23aa489f
MD5 079f3e15f680935375aa39b2b35963c4
SHA1 930b1176534cf922f5bac920efa29776249e9fed
SHA512 85e6dc966b0d87365d261773db4245ca9fd19b722dedbaa10c0f1e8a2f21d68c99e32db5b058fae58543079cfec352f2f29e63144233d0e68086aabd827dfed7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b76b059e9b6dbf4f53e909d014509c3cd863206eca8c215d27dba95d8c281dca
MD5 79a5cb35eea851581791262f316449c2
SHA1 886a9ff0052b1ec58042dc510e6ba0282226411e
SHA512 e216f231f6e4797b1c67b40b6c13cb0e51d68792caca710e67aea6bdcbc1877c87a4162c3a7088d26203eada7c7aa78915edc1e85f307865a3f96e46aba90478
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6e66ccac1addc74973c933c7956a16e5018dca173ae4591cfb5e883f672e5610
MD5 49e9d2016710f705ca83a07d3cb8365a
SHA1 80acafb94edd89b7ae7a2c8adec0c8504263d677
SHA512 6ecc82881dca519224378ccb02b60d75e7ba23b1cbd0eea643bf876b334f786cfb55452bc82b1b3e7ac73c53bd304060eb7535b4de55a16eb9a9d182abfa101f
MD5 SHA1 SHA512

Submit Download

memory/3088-0-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3088-8-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3864-65-0x0000000000020000-0x0000000000041000-memory.dmp

Download

memory/5832-34-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download