31f93a0e99474050d477e94264e876325d56925fa8b5b1a002e06411bb75e03a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_3c0162e64963c23693639b7b6e6d1576_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
Size 17.4MB
Sample260916-2c3s6afa59
SHA256 31f93a0e99474050d477e94264e876325d56925fa8b5b1a002e06411bb75e03a
MD5 3c0162e64963c23693639b7b6e6d1576
SHA1 f3c653710a6479a8349fd4b03e0740e533af86d6
SHA512 22709bb780ae1d52451c078c71e8a083ca73a29d1a647386f139ad2962057322208a00cd69d67aa92e0b8755a3ebf38a2b9810b3abc2cb4c6b711025491f763c
SSDEEP 196608:Zr5pyq2Rj7Mecc2hiLlv0Yn3Q2daGuEi9AwuauYEMbH7DXBiN5NrZvFGEhIpqI:UqwMUFn3jdgukbDINhFN6pz
TLSH
T16C0712037AC280F5E18A093041667B3EBF796A620F14CECB67C4EE656D727D1993634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x0000000001568000-memory.dmp	INDICATOR_SUSPICIOUS_ReflectiveLoader

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x0000000001568000-memory.dmp	UPX

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2396	4468	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_3c0162e64963c23693639b7b6e6d1576_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-16_3c0162e64963c23693639b7b6e6d1576_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_3c0162e64963c23693639b7b6e6d1576_amadey_cobalt-strike_coinminer_darkgate_elex_emotet_glas.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 264
  2⤵
  - Program crash
  PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 4468 -ip 4468
1⤵
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-0-0x0000000000400000-0x0000000001568000-memory.dmp

Download