Overview

overview

7

Static

static

3

2026-04-23...op.exe

windows10-2004-x64

7

2026-04-23...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/04/2026, 04:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-23_2a5d9dbb69d8123e2534ff4f360d5fd9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
  • Size 722KB
  • Sample260423-fenlcsa17x
  • SHA256 6a8de48e753e589fdeecf2ac5a53ade09bea36c19a5bc72ad42a11088ad7bfcd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwarediscoveryspyware

Malware Config

Signatures

  • Executes dropped EXE 17 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-23_2a5d9dbb69d8123e2534ff4f360d5fd9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-23_2a5d9dbb69d8123e2534ff4f360d5fd9_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4696
    • C:\Temp\pjhczurmkecwuomh.exe
      C:\Temp\pjhczurmkecwuomh.exe run
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:6132
        • C:\Temp\wrpjhbztrm.exe
          C:\Temp\wrpjhbztrm.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:2956
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4956
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:5608
        • C:\Temp\i_wrpjhbztrm.exe
          C:\Temp\i_wrpjhbztrm.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:720
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\trmjebwuom.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:5384
        • C:\Temp\trmjebwuom.exe
          C:\Temp\trmjebwuom.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5012
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4988
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2988
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_trmjebwuom.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2396
        • C:\Temp\i_trmjebwuom.exe
          C:\Temp\i_trmjebwuom.exe ups_ins
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3248
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\jdbwtolgey.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:4052
        • C:\Temp\jdbwtolgey.exe
          C:\Temp\jdbwtolgey.exe ups_run
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:6024
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:2232
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 352
        3⤵
        • Program crash
        PID:5544
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4848 CREDAT:17410 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:5448
  • C:\Temp\pjhczurmkecwuomh.sys
    C:\Temp\pjhczurmkecwuomh.sys
    1⤵
    • Executes dropped EXE
    PID:4064
  • C:\Temp\ebwuomgeyw.sys
    C:\Temp\ebwuomgeyw.sys
    1⤵
    • Executes dropped EXE
    PID:1568
  • C:\Temp\qoigbytrlj.sys
    C:\Temp\qoigbytrlj.sys
    1⤵
    • Executes dropped EXE
    PID:3728
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4824 -ip 4824
    1⤵
      PID:5124

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CreateProcess.exe
          • Path C:\Temp\CreateProcess.exe
          • Size 3KB
          • SHA256 087a91f0b10b81d208e809c26e55b780a941952c0f1a24eaa83102c5811b1ea3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ebwuomgeyw.sys
          • Path C:\Temp\ebwuomgeyw.sys
          • Size 293KB
          • SHA256 2bf65f0077b45b755bdfb29d7ec8702b99d80ae1da0c4b665b1d396c1f02111f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i_trmjebwuom.exe
          • Path C:\Temp\i_trmjebwuom.exe
          • Size 722KB
          • SHA256 edc1aaf84d4426744261d364851d949af613bba988b6be3c76e2294da925179d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          i_wrpjhbztrm.exe
          • Path C:\Temp\i_wrpjhbztrm.exe
          • Size 722KB
          • SHA256 2f3f4c3e985c9149cd444660e569e1aa67f8af172aff9927fee0adc5f1f66b68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          jdbwtolgey.exe
          • Path C:\Temp\jdbwtolgey.exe
          • Size 722KB
          • SHA256 a5192ded59e4d2d11865673ba0d5ac0d1d793cecbb596a128b53c79660f460c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pjhczurmkecwuomh.exe
          • Path C:\Temp\pjhczurmkecwuomh.exe
          • Size 722KB
          • SHA256 a9cfdb1b0d2ce47c4df7e981ec682f5e74034efe552129fe9665e86d07238465
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pjhczurmkecwuomh.sys
          • Path C:\Temp\pjhczurmkecwuomh.sys
          • Size 293KB
          • SHA256 62b12ec66d17bc9f71edfd911f666e7b1345c4eaaf5bc8c7d40462b3277dd2f2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          qoigbytrlj.sys
          • Path C:\Temp\qoigbytrlj.sys
          • Size 293KB
          • SHA256 461d935fecf509605b8a8bac48f6f73055b0fc36f66569af2ffcd4c54b61a203
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          trmjebwuom.exe
          • Path C:\Temp\trmjebwuom.exe
          • Size 722KB
          • SHA256 76b6a3bb19b6c2b3189c0a2041b65591110a196c43deab3c15936e7effe24384
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wrpjhbztrm.exe
          • Path C:\Temp\wrpjhbztrm.exe
          • Size 722KB
          • SHA256 8fbbf6995110454f31ad25a04f9a770178336a1bea9d8fa56ca56e6a56862667
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
          • Size 471B
          • SHA256 abfeec53e06634017364ee18cdf521877f776ef1663fbaad02303519bcd7df38
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
          • Size 416B
          • SHA256 1a4eeb5d6bfabe14435169fc8238a351dcf5f795ea397a2ad4c9d3f75c3d8873
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VGXOU86\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1568-21-0x0000000000010000-0x00000000000AB000-memory.dmp
          Download

          memory/3728-33-0x0000000000010000-0x00000000000AB000-memory.dmp
          Download

          memory/4064-14-0x0000000000010000-0x00000000000AB000-memory.dmp
          Download