Overview

overview

10

Static

static

10

2026-09-24..._m.exe

windows10-2004-x64

9

2026-09-24..._m.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 06:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_m.exe
  • Size 6.3MB
  • Sample260925-grf8gsbb38
  • SHA256 7533f82236855f352e3fa9251ed632dc6387450fbecbc034d7ea431b8f7fb594
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionupx

Malware Config

Signatures

  • Detects JavaScript files used for persistence and executable or script execution 1 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_m.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_m.exe"
    1⤵
    • Identifies Wine through registry keys
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3396
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\index.hta?utorrent" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_8319416ca3600be97508058b5b4c6890_coinminer_darkgate_elex_glassworm_hawkeye_luca-stealer_m.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\index.hta.log" /PID "3396" /CID "UBSZQw0tR5rsLiTX" /VERSION "110011685" /BUCKET "0" /SSB "1" /COUNTRY "US" /OS "10.0" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-1404337215-1550464601-2805570857-1000" /CLIENT "utorrent"
      2⤵
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" "shell_scripts/check_if_cscript_is_working.js"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1484
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\System32\PING.EXE" 8.8.8.8 -n 2 -w 500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3320
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.b-000.XYZ.bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjMzOTYiLCJoIjoiVUJTWlF3MHRSNXJzTGlUWCIsInYiOiIxMTAwMTE2ODUiLCJiIjo0MjI3NywiY2wiOiJ1VG9ycmVudCIsIm9zYSI6IjY0Iiwic2xuZyI6ImVuIiwiZGIiOiIiLCJkYnYiOiIxMS4wIiwiaWJyIjpbeyJuYW1lIjoiIiwidmVyc2lvbiI6IjEzNS4wIiwiZXhlTmFtZSI6ImZpcmVmb3gifSx7Im5hbWUiOiIiLCJ2ZXJzaW9uIjoiMTQwLjAiLCJleGVOYW1lIjoiY2hyb21lIn0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjExLjAiLCJleGVOYW1lIjoiaWV4cGxvcmUifSx7Im5hbWUiOiIiLCJ2ZXJzaW9uIjoiMTM5LjAiLCJleGVOYW1lIjoibXNlZGdlIn1dLCJpcCI6Ijg1LjIwMy40Ni4xMzYiLCJjbiI6IlVuaXRlZCBLaW5nZG9tIiwicGFja2lkIjoiZGVmYXVsdCJ9"
        3⤵
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3536
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4860

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          en.json
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\i18n\en.json
          • Size 5KB
          • SHA256 81639b0a15def13cd646efd2ba40442524a3dffae3acd218b812be9f12364cf9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          loading.gif
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\images\loading.gif
          • Size 5KB
          • SHA256 00c62ed42795f996b5f963c69ce918c2623d72896ebb628dfd9bc800514900ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          main_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\images\main_icon.png
          • Size 3KB
          • SHA256 639bccb6ed0fce165cc979a2949d211ec8f1570133d644bf042a5400c3454c21
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main_utorrent.ico
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\images\main_utorrent.ico
          • Size 104KB
          • SHA256 7c7279daebd88f6a34246603db9c0ecf9bbfa35ef820edd3278e5bc53f9e7680
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index.hta
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\index.hta
          • Size 522B
          • SHA256 61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          install.1790316388.zip
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\install.1790316388.zip
          • Size 1.1MB
          • SHA256 4bccd1c076351bd9d81c4133315ed2158fe1a46efde80b2657a71a76bfa32916
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          common.js
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\scripts\common.js
          • Size 389KB
          • SHA256 bea98f89d9185d6a16b2c1e66aeed3d24c720382d32e75ad9b68ce5f95bff328
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          initialize.js
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\scripts\initialize.js
          • Size 978B
          • SHA256 e12037adeb71f62eb46ee77ded18cd226c1beba95b266a2e820cfc6eb0fe5fad
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          install.js
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\scripts\install.js
          • Size 18KB
          • SHA256 0edb18d7ed7cc3a784b28fbed91240f090a95beec8255c7a62660a0787887405
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          check_if_cscript_is_working.js
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\shell_scripts\check_if_cscript_is_working.js
          • Size 18B
          • SHA256 d1b9d32702d7d7a184ab4654c204e6d385a9499fde63e0b06bda60f8077a7862
          • MD5 SHA1 SHA512
          Submit Download

          shell_ping_after_close.js
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\shell_scripts\shell_ping_after_close.js
          • Size 312B
          • SHA256 5e872715109b381c99aa19e2435628640505794e09a1998de7b92c2a5aea38e1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          common.css
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\HTA\styles\common.css
          • Size 99KB
          • SHA256 879fc3da65370131d5363a724b969a23a1f6bb9963284b8418f1e98daf196845
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          index.hta.log
          • Path C:\Users\Admin\AppData\Local\Temp\HYD63B.tmp.1790316388\index.hta.log
          • Size 57B
          • SHA256 0a09d28918eb16816547a01fe0491bfd4fd6feb9f72de40d452b584918529158
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3396-0-0x0000000000400000-0x0000000000A45000-memory.dmp
          Download

          memory/3396-98-0x0000000000400000-0x0000000000A45000-memory.dmp
          Download