0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Size 30.6MB
Sample261026-2wmlaazthw
SHA256 0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a
MD5 7badfe4c14f96222c66f2b584cea1ffe
SHA1 e5fee6a7ce870813b464e7515d9d768fa620f6cb
SHA512 44127dfe052025e4cd9bcc85ae1497af4c7139db4235044a95e04feb0971853b842b64f2e57c4f6876a5a5e0211b020d6d5ef66a39eb22032c82217b83c70d04
SSDEEP 786432:A3RkdObGXYzSm9HWluKGFPt7lgx+ucEBpYcqEc8d+:ukd4zh9HWluKGJt7lgncEBpYcqEc8d+
TLSH
T1ED67AD12A7C640B5FA731730596EE73A873FBA310A31C91FE74C194D9B339919A26723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002466e-94.dat	UPX

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	2216	powershell.exe
26	5084	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
5808	files.dat
204	rld79759.exe
3960	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
432	oinstrun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2216	powershell.exe
3540	powershell.exe
5084	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe
984	cmd.exe
5276	cmd.exe
3728	cmd.exe
3100	cmd.exe
3420	cmd.exe
1628	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld79759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4860	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE

Runs .reg file with regedit 1 IoCs

pid	Process
3724	regedit.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4860	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5956	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2216	powershell.exe
2216	powershell.exe
3540	powershell.exe
3540	powershell.exe
5084	powershell.exe
5084	powershell.exe
432	oinstrun.exe
432	oinstrun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5548	WMIC.exe
Token: SeSecurityPrivilege	5548	WMIC.exe
Token: SeTakeOwnershipPrivilege	5548	WMIC.exe
Token: SeLoadDriverPrivilege	5548	WMIC.exe
Token: SeSystemProfilePrivilege	5548	WMIC.exe
Token: SeSystemtimePrivilege	5548	WMIC.exe
Token: SeProfSingleProcessPrivilege	5548	WMIC.exe
Token: SeIncBasePriorityPrivilege	5548	WMIC.exe
Token: SeCreatePagefilePrivilege	5548	WMIC.exe
Token: SeBackupPrivilege	5548	WMIC.exe
Token: SeRestorePrivilege	5548	WMIC.exe
Token: SeShutdownPrivilege	5548	WMIC.exe
Token: SeDebugPrivilege	5548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5548	WMIC.exe
Token: SeRemoteShutdownPrivilege	5548	WMIC.exe
Token: SeUndockPrivilege	5548	WMIC.exe
Token: SeManageVolumePrivilege	5548	WMIC.exe
Token: 33	5548	WMIC.exe
Token: 34	5548	WMIC.exe
Token: 35	5548	WMIC.exe
Token: 36	5548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5548	WMIC.exe
Token: SeSecurityPrivilege	5548	WMIC.exe
Token: SeTakeOwnershipPrivilege	5548	WMIC.exe
Token: SeLoadDriverPrivilege	5548	WMIC.exe
Token: SeSystemProfilePrivilege	5548	WMIC.exe
Token: SeSystemtimePrivilege	5548	WMIC.exe
Token: SeProfSingleProcessPrivilege	5548	WMIC.exe
Token: SeIncBasePriorityPrivilege	5548	WMIC.exe
Token: SeCreatePagefilePrivilege	5548	WMIC.exe
Token: SeBackupPrivilege	5548	WMIC.exe
Token: SeRestorePrivilege	5548	WMIC.exe
Token: SeShutdownPrivilege	5548	WMIC.exe
Token: SeDebugPrivilege	5548	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5548	WMIC.exe
Token: SeRemoteShutdownPrivilege	5548	WMIC.exe
Token: SeUndockPrivilege	5548	WMIC.exe
Token: SeManageVolumePrivilege	5548	WMIC.exe
Token: 33	5548	WMIC.exe
Token: 34	5548	WMIC.exe
Token: 35	5548	WMIC.exe
Token: 36	5548	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3688	WMIC.exe
Token: SeSecurityPrivilege	3688	WMIC.exe
Token: SeTakeOwnershipPrivilege	3688	WMIC.exe
Token: SeLoadDriverPrivilege	3688	WMIC.exe
Token: SeSystemProfilePrivilege	3688	WMIC.exe
Token: SeSystemtimePrivilege	3688	WMIC.exe
Token: SeProfSingleProcessPrivilege	3688	WMIC.exe
Token: SeIncBasePriorityPrivilege	3688	WMIC.exe
Token: SeCreatePagefilePrivilege	3688	WMIC.exe
Token: SeBackupPrivilege	3688	WMIC.exe
Token: SeRestorePrivilege	3688	WMIC.exe
Token: SeShutdownPrivilege	3688	WMIC.exe
Token: SeDebugPrivilege	3688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3688	WMIC.exe
Token: SeRemoteShutdownPrivilege	3688	WMIC.exe
Token: SeUndockPrivilege	3688	WMIC.exe
Token: SeManageVolumePrivilege	3688	WMIC.exe
Token: 33	3688	WMIC.exe
Token: 34	3688	WMIC.exe
Token: 35	3688	WMIC.exe
Token: 36	3688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3688	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE
5956	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 5276	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	86
PID 1864 wrote to memory of 5360	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	88
PID 5276 wrote to memory of 5548	5276	cmd.exe	90
PID 1864 wrote to memory of 3728	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	91
PID 3728 wrote to memory of 5808	3728	cmd.exe	94
PID 1864 wrote to memory of 3100	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	95
PID 3100 wrote to memory of 3688	3100	cmd.exe	97
PID 1864 wrote to memory of 2216	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	102
PID 1864 wrote to memory of 4944	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	106
PID 1864 wrote to memory of 3540	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	108
PID 1864 wrote to memory of 5084	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	110
PID 1864 wrote to memory of 3420	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	112
PID 1864 wrote to memory of 5956	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	115
PID 1864 wrote to memory of 204	1864	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	116
PID 3420 wrote to memory of 3724	3420	cmd.exe	118
PID 204 wrote to memory of 3960	204	rld79759.exe	119
PID 204 wrote to memory of 1628	204	rld79759.exe	120
PID 3960 wrote to memory of 5844	3960	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	123
PID 3960 wrote to memory of 2612	3960	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	124
PID 1628 wrote to memory of 4860	1628	cmd.exe	127
PID 2612 wrote to memory of 5304	2612	cmd.exe	129
PID 3960 wrote to memory of 984	3960	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	130
PID 984 wrote to memory of 4048	984	cmd.exe	132
PID 3960 wrote to memory of 432	3960	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
  2⤵
  PID:5360
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5808
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\Admin\AppData\Local\Temp\over9661263\v32.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Windows\SysWOW64\expand.exe
  "expand" v32.cab -F:VersionDescriptor.xml C:\Users\Admin\AppData\Local\Temp\over9661263
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4944
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { Get-Content C:\Users\Admin\AppData\Local\Temp\over9661263\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\Admin\AppData\Local\Temp\over4169559\v32.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\regedit.exe
    regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
    3⤵
    - Runs .reg file with regedit
    PID:3724
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5956
- C:\Users\Admin\AppData\Local\Temp\rld79759.exe
  "C:\Users\Admin\AppData\Local\Temp\rld79759.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe" 1000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\reg.exe
      "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
      4⤵
      PID:5844
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5304
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
      "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD55642.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 7ae7ffba8856f4f1a3368d3d9e206824319cbb9ace08c1f3d9e0d25fefb9787d
MD5 1001b1d5de07f99b6636ac71410017eb
SHA1 80736f934619c897d2ff029b74c06f7216398452
SHA512 cf08e268cdd4ea9bd024527c6851831dd34edce05fb329bc05dc06896bffa84986086535899161a428ff1b49e88c893ffc865836552e0daa2836e73b808620af
SSDEEP 384:srf+j09i+eN3+0BFE1JkAHo2TpK6seY7Ug/qi3SoZflh6UPEB1o8Mo1XzETD:mf+dbvE0qo2TpNQ/5S04SEBOXym
TLSH
T16582B55E611F16C3C4811378E11B051FE8F2DE8D531A03D8BB6E9F3B8AACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 ed58c0c886e35ed7fa9f80be2e4680441147976c6874b653adb739f5762990b9
MD5 ac7cf9904c778f927fdbe90bcf9e11a5
SHA1 ee061f05947ac9b4f52527b60dea7328f798e22b
SHA512 74f02ca7503fb9d0c87e1297d8f18e5e43e54d0dac7deb9149d2f0e64a32e0388cba5962ec03340d4db1f099626eeab0b5b7747a09828213d0b75ba074cc452e
SSDEEP 384:Csb+TW291VT5OnwiUiNFA1NY1BiNfPcYK1juXcjCjp7vZS0oFD63f:C490VTQwijNFA1Nmi+YSjus0pjno6
TLSH
T165822A6D222F26D2D0A153B0D42B079BFCF09DCFD38507DC5B4C1E3B59A966B84A60E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Size 30.6MB
SHA256 0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a
MD5 7badfe4c14f96222c66f2b584cea1ffe
SHA1 e5fee6a7ce870813b464e7515d9d768fa620f6cb
SHA512 44127dfe052025e4cd9bcc85ae1497af4c7139db4235044a95e04feb0971853b842b64f2e57c4f6876a5a5e0211b020d6d5ef66a39eb22032c82217b83c70d04
SSDEEP 786432:A3RkdObGXYzSm9HWluKGFPt7lgx+ucEBpYcqEc8d+:ukd4zh9HWluKGJt7lgncEBpYcqEc8d+
TLSH
T1ED67AD12A7C640B5FA731730596EE73A873FBA310A31C91FE74C194D9B339919A26723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfD55642.bat

Path C:\Users\Admin\AppData\Local\Temp\SelfD55642.bat
Size 157B
SHA256 dcabe81a95e39169f5a3bf71befa9cad9e4a7acc20ca78334f5ff85b1547be44
MD5 f4d15ed4e8d365d4a6fb78b44f42905d
SHA1 483ddf1df4aec4ff672d9e179d8e748611a66380
SHA512 6b16b6c6408a5744792b5d62f1cbf7522a49c3a45b7548122d258d912986d70ca747acdd5ca6df84b8ae7b473228a04606300432fd082dfc4207564022d56c5e
TLSH
T1D3C080145BC7C3160448817B0B18D54CC0754C9E2F0D2F11A7604C4C81C111C7740701
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nuaszv4u.g12.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nuaszv4u.g12.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
Size 1KB
SHA256 2d9c80747d46fcb3dbb0a3f0d6c7cde8bd7fd6584481017867ae8998adde147b
MD5 634d6bcda393c7a125881e6ddb873e9c
SHA1 e89686c6997193c395dc9d793154fd6e7294c510
SHA512 d9d3c3f67de193aea3dedc9ce9b8ff783ed89bf4c279e3bcedbf88f10fb6d472e704074ec3a5d270d1bb49ad8ca7e62e8ded6657355372a600cb82dddb0d3c90
TLSH
T1DE11E7869A895C7C72364322F296CFC87F79680397141CB0B0CF291B2F51164136B09F
MD5 SHA1 SHA512 TLSH

Submit Download

Configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
Size 836B
SHA256 cdcd3fa3cb1ebfafc98273ae52632f80b95cb9d25933ee1c7d2fdec640b264d0
MD5 f693e4fb8d3907e6cc44a34e1cc87296
SHA1 e3b646ddeeb72d1e2fd9e6ea654aca44d61feb5f
SHA512 b0e71e9e00b153229c61c9a063bb098bd75333e8526cbf91afa36955430b21902ce38a04783f9a0f56364a13a2e2ea64dbc2051348e5a26df4f5edfded254a24
TLSH
T10201D6869B845C7D72360332E286CFC8BF392903970528A0B0CF656F6FA1464135B09F
MD5 SHA1 SHA512 TLSH

Submit Download

configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\configure.xml
Size 1KB
SHA256 e292d515b5980b995ce92a583c583fc66eea3b1c98be865db981a8e645dd842f
MD5 a69654eb2545d52ae06b68cead7a4ece
SHA1 cbededc4b5db2341304c0e2e16787078c89e78e9
SHA512 1c7549065ddd4cce8c71bf547c6f0a64282830060c9e3e4026e3d86fd337482b6e8ca4988f2353083d81fed93c1723251df5b7bbfc0f72b859865fc5f34b8202
TLSH
T1DE2129869E895C7C76360321F296CFC8BF79641357141CA0B0CF6A1F2F62164136B09F
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 765KB
SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
MD5 bb5569b15d68c10b7ff2d96b45825120
SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
TLSH
T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 7.3MB
SHA256 3921739750770747349e1bbd05e4a06865e8ee1553ca7063b047e11bc18b848a
MD5 25faf73dfd6e6e317e0feac53d45280b
SHA1 bf5e2fcc860b4dea163280c8baf6629ccaa87ae3
SHA512 642ba912aeb997c38dcaebb254b0a8363fd83f48bebe32f282e2ef6257a2674013a50dc22f6f276483d0744d38801684f2263d7898b4522fb70987287849aebe
SSDEEP 196608:E8OU6EBTlYaphOIgJW1q1ANtR0h8K++K8XQGJP1j4caI6HMaJTtGb75:hcEBpYcqER0h8dGJP94+5
TLSH
T183767C2267D580B6FBB22F706D7FA75543BABE710B30811F23441ACD09709B5E92A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newui.reg

Path C:\Users\Admin\AppData\Local\Temp\newui.reg
Size 1KB
SHA256 92dc5f009e30e42d18b80fdcce0e029df6d56e387eb38e16c5585a9c5a0b41a7
MD5 7fb2bda7ca25568909eab0b872416ada
SHA1 23295a06a82a9ef408ec0409e6bc5f15c045c895
SHA512 ea07f1a90991410d044bfc0420c2de4d2e445b30c62199277ab26b9a8ba11603e0652caa24bb26a2429cc6c12d76fc627751476b133158617e4439a7e59a883d
TLSH
T14B31F593E0158632E0553F1175932F893BBA03C77467ADE6832940D42266957C3D7AB7
MD5 SHA1 SHA512 TLSH

Submit Download

oinstrun.exe

Path C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
Size 14KB
SHA256 4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d
MD5 32973232138fc6b30d913167096c059d
SHA1 d6a7cb95d5525ea3d7286749663e12c1addb3104
SHA512 ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f
SSDEEP 384:t0TE7lQWycenV30bCeFBgb4kkAeZn9N9TsW0ClG6VEu2QWGrWvNUTsrwHaU:t0T0lQhUs
TLSH
T1FA62A38097EC4499F0FB4F30EDBA41029ABAFD515E75D12F0150508E1AB2B61DE7AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rld79759.exe

Path C:\Users\Admin\AppData\Local\Temp\rld79759.exe
Size 16KB
SHA256 03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f
MD5 fc8ec75b7b5f3a2be9fdc67ee8808afa
SHA1 e5723567f6f3d12c2eaea3d07955cf5a259c8a8f
SHA512 c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a
SSDEEP 192:WnI7XWYyywYGoT8uiAe+jlsSUFagW+b43iyRJvaofC1upLKLw9glGfqWJJR48F8:YWGYyjuQ++SUcgxNualcpLT9wGlJM8O
TLSH
T1AB722A23EEC168F6E6D380B30BB59927DD35121153444AD7E3EC9DA93B105D0E73A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-30-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/2216-42-0x00000000063B0000-0x00000000063CA000-memory.dmp

Download

memory/2216-41-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Download

memory/2216-40-0x0000000005EB0000-0x0000000005EFC000-memory.dmp

Download

memory/2216-39-0x0000000005E70000-0x0000000005E8E000-memory.dmp

Download

memory/2216-38-0x00000000058C0000-0x0000000005C14000-memory.dmp

Download

memory/2216-29-0x00000000057E0000-0x0000000005846000-memory.dmp

Download

memory/2216-28-0x0000000004FF0000-0x0000000005012000-memory.dmp

Download

memory/2216-27-0x00000000050C0000-0x00000000056E8000-memory.dmp

Download

memory/2216-26-0x00000000028A0000-0x00000000028D6000-memory.dmp

Download

memory/3540-55-0x0000000007150000-0x00000000071E6000-memory.dmp

Download

memory/3540-57-0x00000000077A0000-0x0000000007D44000-memory.dmp

Download

memory/3540-56-0x00000000064A0000-0x00000000064C2000-memory.dmp

Download

memory/3540-53-0x0000000005A70000-0x0000000005DC4000-memory.dmp

Download

memory/5956-86-0x00007FF81EB90000-0x00007FF81EBA0000-memory.dmp

Download

memory/5956-87-0x00007FF81EB90000-0x00007FF81EBA0000-memory.dmp

Download

memory/5956-88-0x00007FF81EB90000-0x00007FF81EBA0000-memory.dmp

Download

memory/5956-84-0x00007FF81EB90000-0x00007FF81EBA0000-memory.dmp

Download

memory/5956-90-0x00007FF81C530000-0x00007FF81C540000-memory.dmp

Download

memory/5956-91-0x00007FF81C530000-0x00007FF81C540000-memory.dmp

Download

memory/5956-85-0x00007FF81EB90000-0x00007FF81EBA0000-memory.dmp

Download