Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 12:08
Behavioral task
behavioral1
Sample
2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe
- Size 1024KB
- Sample260925-pawkvaxv2r
- SHA256 b4ca9013289d0a77798f6b8bb363442c8b3bedd6800ee98604d9768aa39040e1
- MD5 359380f229b76cbd1b3fa758c7708bd1
- SHA1 95e615bee572200e120a80795ac72e54162e7ab3
- SHA512 0aa6df2f60d48839bd18575b232f319ab0272c548de113b75bd2f9ffff855ce454914629373a0f96a34cfd220d94c135b716b00a1996bb0c3eddb9a50a29f273
- SSDEEP 24576:ZjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ZTGkQyhuTtS0rQi
- TLSH T12725AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral2/memory/5924-0-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/files/0x000900000001b2ca-2.dat UPX behavioral2/memory/5080-3-0x0000000000780000-0x0000000000809000-memory.dmp UPX behavioral2/memory/5924-25-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5080-27-0x0000000000780000-0x0000000000809000-memory.dmp UPX behavioral2/memory/5080-33-0x0000000000780000-0x0000000000809000-memory.dmp UPX behavioral2/memory/5924-54-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5080-55-0x0000000000780000-0x0000000000809000-memory.dmp UPX behavioral2/memory/5924-60-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5080-64-0x0000000000780000-0x0000000000809000-memory.dmp UPX behavioral2/memory/5924-65-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5924-72-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5924-75-0x0000000000790000-0x0000000000819000-memory.dmp UPX behavioral2/memory/5924-76-0x0000000000790000-0x0000000000819000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5080 29b061e0 - Unexpected DNS network traffic destination 22 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 1 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 150 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 236 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 290 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 294 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 379 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 433 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 4 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 288 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 434 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 41 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 95 114.114.114.114 5080 29b061e0 Destination IP 96 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 149 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 181 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 182 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 235 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 293 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 42 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 325 114.114.114.114 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 326 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Destination IP 380 223.5.5.5 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 29b061e0 File created C:\Windows\SysWOW64\29b061e0 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 29b061e0 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 29b061e0 -
resource yara_rule behavioral2/memory/5924-0-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/files/0x000900000001b2ca-2.dat upx behavioral2/memory/5080-3-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral2/memory/5924-25-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5080-27-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral2/memory/5080-33-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral2/memory/5924-54-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5080-55-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral2/memory/5924-60-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5080-64-0x0000000000780000-0x0000000000809000-memory.dmp upx behavioral2/memory/5924-65-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5924-72-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5924-75-0x0000000000790000-0x0000000000819000-memory.dmp upx behavioral2/memory/5924-76-0x0000000000790000-0x0000000000819000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\56f8b0 29b061e0 File opened for modification C:\Windows\656bc8 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29b061e0 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 29b061e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 29b061e0 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 29b061e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 29b061e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 29b061e0 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 29b061e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 29b061e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 29b061e0 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 29b061e0 - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5080 29b061e0 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Token: SeTcbPrivilege 5924 2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe Token: SeDebugPrivilege 5080 29b061e0 Token: SeTcbPrivilege 5080 29b061e0
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_359380f229b76cbd1b3fa758c7708bd1_coinminer_elex_glassworm_kwampirs_mafia.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5924
-
C:\Windows\Syswow64\29b061e0C:\Windows\Syswow64\29b061e01⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\56f8b0
- Size 916B
- SHA256 d50488576e4abbbfe98e105630dc67515d05b3ae724d9a7bd6a98a6dadbd5589
- MD5 80e51523e7d70a14f331f9b20ecabc30
- SHA1 56557f068aa63389eeb096a9c8c9f8f53cd225df
- SHA512 1395253762c1da0457b84ee7726ad230aa3ee555d0d86326f5efe5f9ebc7145b5bccf43d75a35cc63f26bdb3a4352cd69664d1770fc31ee41a4107e341cfa577
- TLSH T1D5110A3165AADAF29DE9456436F37DD8BF38B4D6C4CA4197289270A812133DCC47B482
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\29b061e0
- Size 1024KB
- SHA256 2365a2525477d159c8cf2ff5d7417ec6a25a1b1630d530b9f246fb28d6b69783
- MD5 3fd9ab4e8621390fce6b506aa98a46ce
- SHA1 9fbfefde2837a3b0c7a6d53bb4cc0cd36b877f9e
- SHA512 93956a86a232c1bd84a9591fd6695b65edf2c3f0d5c51baf2e11b40c6f6b677f1611bee1addc15e0845c3ac6453f51e5d262997da8890b96ef6145da6a981a76
- SSDEEP 24576:ZjHPOSOkx2LFshuZ98Es8k3OH3C0rQ6+y:ZTGkQyhuTtS0rQi
- TLSH T1A325AF31E242C03AD5A70172C6BE0BAF95787D25472951C7A3D43D6A2FB22D2AE3570F
- MD5 SHA1 SHA512 SSDEEP TLSH