0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Size 30.6MB
Sample261026-2wmlaazthw
SHA256 0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a
MD5 7badfe4c14f96222c66f2b584cea1ffe
SHA1 e5fee6a7ce870813b464e7515d9d768fa620f6cb
SHA512 44127dfe052025e4cd9bcc85ae1497af4c7139db4235044a95e04feb0971853b842b64f2e57c4f6876a5a5e0211b020d6d5ef66a39eb22032c82217b83c70d04
SSDEEP 786432:A3RkdObGXYzSm9HWluKGFPt7lgx+ucEBpYcqEc8d+:ukd4zh9HWluKGJt7lgncEBpYcqEc8d+
TLSH
T1ED67AD12A7C640B5FA731730596EE73A873FBA310A31C91FE74C194D9B339919A26723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4eb-74.dat	UPX

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	252	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3716	files.dat
4432	rld25573.exe
4500	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
2408	oinstrun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe
252	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2752	cmd.exe
4408	cmd.exe
4732	cmd.exe
704	cmd.exe
3204	cmd.exe
2612	cmd.exe
4660	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rld25573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	files.dat
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4284	PING.EXE
716	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	OUTLOOK.EXE

Runs .reg file with regedit 1 IoCs

pid	Process
6024	regedit.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4284	PING.EXE
716	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3900	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4172	WMIC.exe
4172	WMIC.exe
4172	WMIC.exe
4172	WMIC.exe
3412	WMIC.exe
3412	WMIC.exe
3412	WMIC.exe
3412	WMIC.exe
252	powershell.exe
252	powershell.exe
3136	powershell.exe
3136	powershell.exe
4068	WMIC.exe
4068	WMIC.exe
4068	WMIC.exe
4068	WMIC.exe
4948	WMIC.exe
4948	WMIC.exe
4948	WMIC.exe
4948	WMIC.exe
2408	oinstrun.exe
2408	oinstrun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3900	OUTLOOK.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4172	WMIC.exe
Token: SeSecurityPrivilege	4172	WMIC.exe
Token: SeTakeOwnershipPrivilege	4172	WMIC.exe
Token: SeLoadDriverPrivilege	4172	WMIC.exe
Token: SeSystemProfilePrivilege	4172	WMIC.exe
Token: SeSystemtimePrivilege	4172	WMIC.exe
Token: SeProfSingleProcessPrivilege	4172	WMIC.exe
Token: SeIncBasePriorityPrivilege	4172	WMIC.exe
Token: SeCreatePagefilePrivilege	4172	WMIC.exe
Token: SeBackupPrivilege	4172	WMIC.exe
Token: SeRestorePrivilege	4172	WMIC.exe
Token: SeShutdownPrivilege	4172	WMIC.exe
Token: SeDebugPrivilege	4172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4172	WMIC.exe
Token: SeRemoteShutdownPrivilege	4172	WMIC.exe
Token: SeUndockPrivilege	4172	WMIC.exe
Token: SeManageVolumePrivilege	4172	WMIC.exe
Token: 33	4172	WMIC.exe
Token: 34	4172	WMIC.exe
Token: 35	4172	WMIC.exe
Token: 36	4172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4172	WMIC.exe
Token: SeSecurityPrivilege	4172	WMIC.exe
Token: SeTakeOwnershipPrivilege	4172	WMIC.exe
Token: SeLoadDriverPrivilege	4172	WMIC.exe
Token: SeSystemProfilePrivilege	4172	WMIC.exe
Token: SeSystemtimePrivilege	4172	WMIC.exe
Token: SeProfSingleProcessPrivilege	4172	WMIC.exe
Token: SeIncBasePriorityPrivilege	4172	WMIC.exe
Token: SeCreatePagefilePrivilege	4172	WMIC.exe
Token: SeBackupPrivilege	4172	WMIC.exe
Token: SeRestorePrivilege	4172	WMIC.exe
Token: SeShutdownPrivilege	4172	WMIC.exe
Token: SeDebugPrivilege	4172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4172	WMIC.exe
Token: SeRemoteShutdownPrivilege	4172	WMIC.exe
Token: SeUndockPrivilege	4172	WMIC.exe
Token: SeManageVolumePrivilege	4172	WMIC.exe
Token: 33	4172	WMIC.exe
Token: 34	4172	WMIC.exe
Token: 35	4172	WMIC.exe
Token: 36	4172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3412	WMIC.exe
Token: SeSecurityPrivilege	3412	WMIC.exe
Token: SeTakeOwnershipPrivilege	3412	WMIC.exe
Token: SeLoadDriverPrivilege	3412	WMIC.exe
Token: SeSystemProfilePrivilege	3412	WMIC.exe
Token: SeSystemtimePrivilege	3412	WMIC.exe
Token: SeProfSingleProcessPrivilege	3412	WMIC.exe
Token: SeIncBasePriorityPrivilege	3412	WMIC.exe
Token: SeCreatePagefilePrivilege	3412	WMIC.exe
Token: SeBackupPrivilege	3412	WMIC.exe
Token: SeRestorePrivilege	3412	WMIC.exe
Token: SeShutdownPrivilege	3412	WMIC.exe
Token: SeDebugPrivilege	3412	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3412	WMIC.exe
Token: SeRemoteShutdownPrivilege	3412	WMIC.exe
Token: SeUndockPrivilege	3412	WMIC.exe
Token: SeManageVolumePrivilege	3412	WMIC.exe
Token: 33	3412	WMIC.exe
Token: 34	3412	WMIC.exe
Token: 35	3412	WMIC.exe
Token: 36	3412	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3412	WMIC.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 23 IoCs

pid	Process
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE
3900	OUTLOOK.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3204	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	89
PID 4780 wrote to memory of 936	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	90
PID 3204 wrote to memory of 4172	3204	cmd.exe	93
PID 4780 wrote to memory of 2612	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	94
PID 2612 wrote to memory of 3716	2612	cmd.exe	97
PID 4780 wrote to memory of 4660	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	98
PID 4660 wrote to memory of 3412	4660	cmd.exe	100
PID 4780 wrote to memory of 252	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	101
PID 4780 wrote to memory of 572	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	103
PID 4780 wrote to memory of 3136	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	105
PID 4780 wrote to memory of 2752	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	107
PID 4780 wrote to memory of 3900	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	109
PID 4780 wrote to memory of 4432	4780	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	110
PID 2752 wrote to memory of 6024	2752	cmd.exe	111
PID 4432 wrote to memory of 4500	4432	rld25573.exe	113
PID 4432 wrote to memory of 4408	4432	rld25573.exe	114
PID 4500 wrote to memory of 2384	4500	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	116
PID 4500 wrote to memory of 4732	4500	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	117
PID 4408 wrote to memory of 4284	4408	cmd.exe	120
PID 4732 wrote to memory of 4068	4732	cmd.exe	121
PID 4408 wrote to memory of 716	4408	cmd.exe	122
PID 4500 wrote to memory of 704	4500	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	123
PID 704 wrote to memory of 4948	704	cmd.exe	125
PID 4500 wrote to memory of 2408	4500	2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
  2⤵
  PID:936
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3716
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/5030841d-c919-4594-8d2d-84ae4f96e58e/Office/Data/v32.cab', 'C:\Users\Admin\AppData\Local\Temp\over7431876\v32.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:252
- C:\Windows\SysWOW64\expand.exe
  "expand" v32.cab -F:VersionDescriptor.xml C:\Users\Admin\AppData\Local\Temp\over7431876
  2⤵
  - System Location Discovery: System Language Discovery
  PID:572
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { Get-Content C:\Users\Admin\AppData\Local\Temp\over7431876\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\regedit.exe
    regedit.exe -s C:\Users\Admin\AppData\Local\Temp\newui.reg
    3⤵
    - Runs .reg file with regedit
    PID:6024
- C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
  "C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3900
- C:\Users\Admin\AppData\Local\Temp\rld25573.exe
  "C:\Users\Admin\AppData\Local\Temp\rld25573.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe" 1000
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\reg.exe
      "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
      4⤵
      PID:2384
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4732
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4068
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:704
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
      "C:\Users\Admin\AppData\Local\Temp\oinstrun.exe" "C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\SelfD2539.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4284
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 0956576aa85157c27af6cae1a8834c2ad5fc6f26f1584af2fc0fef74bb67cb4d
MD5 d33aadccff86d14aa158b1c6ec9cef80
SHA1 216fa6d0e2db7a436fc9a03eedc00445d9c6245a
SHA512 8c086a965121659829823335819c70fbfeacadd6ffa28ca1505c04f4cc02aba81ac9a6bf2da4453582d47021911f5ea652e621beb76d2a298918e7aedfae26ae
SSDEEP 384:z1TBaGV1igGW14b4M97dn+mGXJxwrPe2j0dIAXk4VRNQWle52h6/2bhNLrEBwEkd:hTnfeWi9Fdn+mWe/WIAXkIN/8ubhNfMA
TLSH
T15C92B868213F6DC7D89222B450D602F7FBE4D049DA755198FE2BCE2F5C90EB64FA1620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-25_7badfe4c14f96222c66f2b584cea1ffe_amadey_coinminer_cryptbot_darkgate_elex_glassworm_luca-s.exe
Size 30.6MB
SHA256 0f3c5dc4a054d86a2d42528d94b356c9f9a5599bd7540c936d564e7f800b645a
MD5 7badfe4c14f96222c66f2b584cea1ffe
SHA1 e5fee6a7ce870813b464e7515d9d768fa620f6cb
SHA512 44127dfe052025e4cd9bcc85ae1497af4c7139db4235044a95e04feb0971853b842b64f2e57c4f6876a5a5e0211b020d6d5ef66a39eb22032c82217b83c70d04
SSDEEP 786432:A3RkdObGXYzSm9HWluKGFPt7lgx+ucEBpYcqEc8d+:ukd4zh9HWluKGJt7lgncEBpYcqEc8d+
TLSH
T1ED67AD12A7C640B5FA731730596EE73A873FBA310A31C91FE74C194D9B339919A26723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfD2539.bat

Path C:\Users\Admin\AppData\Local\Temp\SelfD2539.bat
Size 157B
SHA256 75d1ed62002bf0930731d86d096453dceb2a45aeec61dee52fe8e3102621e173
MD5 b0575c54905b89a96003cbbd3190825f
SHA1 3513ec1cf74ad3f6e86cd23674aaf56d94f6bd7f
SHA512 57daac196ee00b04319be5f9db8b7d2b258492590b9f92d359ae0d1d5251af325bbe2241c44307373e1e85dc29f2bcd880b60131cd922e9fddce3aea885efefd
TLSH
T16AC080315FC7C315040CD1770A18D14CC0755C8E7F053715A7204C4C81C101C6750601
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gx0jrl0i.r3z.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gx0jrl0i.r3z.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
Size 836B
SHA256 cdcd3fa3cb1ebfafc98273ae52632f80b95cb9d25933ee1c7d2fdec640b264d0
MD5 f693e4fb8d3907e6cc44a34e1cc87296
SHA1 e3b646ddeeb72d1e2fd9e6ea654aca44d61feb5f
SHA512 b0e71e9e00b153229c61c9a063bb098bd75333e8526cbf91afa36955430b21902ce38a04783f9a0f56364a13a2e2ea64dbc2051348e5a26df4f5edfded254a24
TLSH
T10201D6869B845C7D72360332E286CFC8BF392903970528A0B0CF656F6FA1464135B09F
MD5 SHA1 SHA512 TLSH

Submit Download

Configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
Size 1KB
SHA256 2d9c80747d46fcb3dbb0a3f0d6c7cde8bd7fd6584481017867ae8998adde147b
MD5 634d6bcda393c7a125881e6ddb873e9c
SHA1 e89686c6997193c395dc9d793154fd6e7294c510
SHA512 d9d3c3f67de193aea3dedc9ce9b8ff783ed89bf4c279e3bcedbf88f10fb6d472e704074ec3a5d270d1bb49ad8ca7e62e8ded6657355372a600cb82dddb0d3c90
TLSH
T1DE11E7869A895C7C72364322F296CFC87F79680397141CB0B0CF291B2F51164136B09F
MD5 SHA1 SHA512 TLSH

Submit Download

configure.xml

Path C:\Users\Admin\AppData\Local\Temp\files\configure.xml
Size 1KB
SHA256 e292d515b5980b995ce92a583c583fc66eea3b1c98be865db981a8e645dd842f
MD5 a69654eb2545d52ae06b68cead7a4ece
SHA1 cbededc4b5db2341304c0e2e16787078c89e78e9
SHA512 1c7549065ddd4cce8c71bf547c6f0a64282830060c9e3e4026e3d86fd337482b6e8ca4988f2353083d81fed93c1723251df5b7bbfc0f72b859865fc5f34b8202
TLSH
T1DE2129869E895C7C76360321F296CFC8BF79641357141CA0B0CF6A1F2F62164136B09F
MD5 SHA1 SHA512 TLSH

Submit Download

files.dat

Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
Size 765KB
SHA256 4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e
MD5 bb5569b15d68c10b7ff2d96b45825120
SHA1 d6d2ed450aae4552f550f59bffe3dd42d8377835
SHA512 640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957
SSDEEP 12288:qXRqml2fcarViUC6TViXyKxhqahbqiR6WEttE6iITi44eKwV3uSI:ygEGcarV7CqViXtxAadq/WEtO8O/en9S
TLSH
T1C2F402313AE6C2BBD643123185CCBBB5B1EA97490F1528C323D4CF1D6F798A6D239919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
Size 7.3MB
SHA256 3921739750770747349e1bbd05e4a06865e8ee1553ca7063b047e11bc18b848a
MD5 25faf73dfd6e6e317e0feac53d45280b
SHA1 bf5e2fcc860b4dea163280c8baf6629ccaa87ae3
SHA512 642ba912aeb997c38dcaebb254b0a8363fd83f48bebe32f282e2ef6257a2674013a50dc22f6f276483d0744d38801684f2263d7898b4522fb70987287849aebe
SSDEEP 196608:E8OU6EBTlYaphOIgJW1q1ANtR0h8K++K8XQGJP1j4caI6HMaJTtGb75:hcEBpYcqER0h8dGJP94+5
TLSH
T183767C2267D580B6FBB22F706D7FA75543BABE710B30811F23441ACD09709B5E92A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

newui.reg

Path C:\Users\Admin\AppData\Local\Temp\newui.reg
Size 1KB
SHA256 92dc5f009e30e42d18b80fdcce0e029df6d56e387eb38e16c5585a9c5a0b41a7
MD5 7fb2bda7ca25568909eab0b872416ada
SHA1 23295a06a82a9ef408ec0409e6bc5f15c045c895
SHA512 ea07f1a90991410d044bfc0420c2de4d2e445b30c62199277ab26b9a8ba11603e0652caa24bb26a2429cc6c12d76fc627751476b133158617e4439a7e59a883d
TLSH
T14B31F593E0158632E0553F1175932F893BBA03C77467ADE6832940D42266957C3D7AB7
MD5 SHA1 SHA512 TLSH

Submit Download

oinstrun.exe

Path C:\Users\Admin\AppData\Local\Temp\oinstrun.exe
Size 14KB
SHA256 4a01c55f4727b3771c2672421aa2c5c20534ad0530449ed168a16a3d33345d3d
MD5 32973232138fc6b30d913167096c059d
SHA1 d6a7cb95d5525ea3d7286749663e12c1addb3104
SHA512 ce0ca843705f7059bad14260a48647797a6cb2d84c162aa943eb090a7d18f708a3403d94f92fbc67c1b1216f941bf591f358e35fef76db34125f37595e256b9f
SSDEEP 384:t0TE7lQWycenV30bCeFBgb4kkAeZn9N9TsW0ClG6VEu2QWGrWvNUTsrwHaU:t0T0lQhUs
TLSH
T1FA62A38097EC4499F0FB4F30EDBA41029ABAFD515E75D12F0150508E1AB2B61DE7AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rld25573.exe

Path C:\Users\Admin\AppData\Local\Temp\rld25573.exe
Size 16KB
SHA256 03382bd8037a9cf6905c87b98b6768bd93fec22faf2f4092d81ac970703ea14f
MD5 fc8ec75b7b5f3a2be9fdc67ee8808afa
SHA1 e5723567f6f3d12c2eaea3d07955cf5a259c8a8f
SHA512 c83ee781775fef4f65244b108bd9ac88643340375b0a2880af9c5d44259ea2f416130c01da0279eb2683988fdf7fc1f8a91e5b013bef28ceb3a086da5ac8bc2a
SSDEEP 192:WnI7XWYyywYGoT8uiAe+jlsSUFagW+b43iyRJvaofC1upLKLw9glGfqWJJR48F8:YWGYyjuQ++SUcgxNualcpLT9wGlJM8O
TLSH
T1AB722A23EEC168F6E6D380B30BB59927DD35121153444AD7E3EC9DA93B105D0E73A275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-34-0x0000000005FB0000-0x0000000005FCE000-memory.dmp

Download

memory/252-29-0x00000000059C0000-0x0000000005A26000-memory.dmp

Download

memory/252-36-0x00000000077F0000-0x0000000007E6C000-memory.dmp

Download

memory/252-35-0x0000000005FF0000-0x000000000603C000-memory.dmp

Download

memory/252-33-0x0000000005B90000-0x0000000005EEB000-memory.dmp

Download

memory/252-26-0x0000000002AD0000-0x0000000002B06000-memory.dmp

Download

memory/252-37-0x0000000006510000-0x000000000652A000-memory.dmp

Download

memory/252-27-0x0000000005210000-0x000000000585A000-memory.dmp

Download

memory/252-28-0x0000000005860000-0x0000000005882000-memory.dmp

Download

memory/252-30-0x0000000005A30000-0x0000000005A96000-memory.dmp

Download

memory/3136-53-0x0000000006DF0000-0x0000000006E12000-memory.dmp

Download

memory/3136-51-0x0000000007B70000-0x0000000007C06000-memory.dmp

Download

memory/3136-60-0x00000000081D0000-0x000000000878A000-memory.dmp

Download

memory/3900-66-0x00007FF8A7960000-0x00007FF8A7970000-memory.dmp

Download

memory/3900-69-0x00007FF8A50B0000-0x00007FF8A50C0000-memory.dmp

Download

memory/3900-70-0x00007FF8A50B0000-0x00007FF8A50C0000-memory.dmp

Download

memory/3900-64-0x00007FF8A7960000-0x00007FF8A7970000-memory.dmp

Download

memory/3900-65-0x00007FF8A7960000-0x00007FF8A7970000-memory.dmp

Download

memory/3900-67-0x00007FF8A7960000-0x00007FF8A7970000-memory.dmp

Download

memory/3900-63-0x00007FF8A7960000-0x00007FF8A7970000-memory.dmp

Download