948466b5895ef0f3b7ac7a4f44d57aeb63af14fd5fc45b2d8e0570908c6659e0

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 11:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 2.8MB
Sample260423-nktcssbw9n
SHA256 948466b5895ef0f3b7ac7a4f44d57aeb63af14fd5fc45b2d8e0570908c6659e0
MD5 d2b3703cc211933f557f6b7c2b725d3b
SHA1 5de7e4e14302d454d0a68b9dc54ec06f97eaa6cc
SHA512 06d9818e1564efe62637356925472bbbeed7be676faf3a886e6014fc7bfcd03c87f19c166814d1e4ebf2d01cc6883c33fc64609df2fcf44f27674f938cbd286e
SSDEEP 49152:51WA6pG3aXLOYIyyp6KrCshPT1ly2a3Remy+gUmy+gl+M8EoIatQFnrhO7D80xac:51t6Ua7YwKrCST1lEpy+gry+gl2Eoi9G
TLSH
T10FD52210F6C2D032E5B141301EB8E7B2556E7C301F3159EBB3C4966AE9741E25A7AFA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
4276	powershell.exe

Modifies Windows Firewall 2 TTPs 8 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5352	netsh.exe
2692	netsh.exe
1176	netsh.exe
1256	netsh.exe
5032	netsh.exe
4376	netsh.exe
3816	netsh.exe
4512	netsh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4276	powershell.exe
4276	powershell.exe
5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 5032	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	80
PID 5184 wrote to memory of 1176	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	82
PID 5184 wrote to memory of 1256	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	84
PID 5184 wrote to memory of 4376	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	86
PID 5184 wrote to memory of 3816	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	88
PID 5184 wrote to memory of 4512	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	90
PID 5184 wrote to memory of 5352	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	92
PID 5184 wrote to memory of 2692	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	94
PID 5184 wrote to memory of 4276	5184	2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_d2b3703cc211933f557f6b7c2b725d3b_agent-tesla_amadey_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="jx2hoiuc.com Game In"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="jx2hoiuc.com Game Out"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1176
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="jx2hoiuc.com Auto In"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1256
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall delete rule name="jx2hoiuc.com Auto Out"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4376
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="jx2hoiuc.com Game In" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\so2game.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3816
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="jx2hoiuc.com Game Out" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\so2game.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4512
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="jx2hoiuc.com Auto In" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\AutoUpdate.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5352
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="jx2hoiuc.com Auto Out" dir=out action=allow program="C:\Users\Admin\AppData\Local\Temp\AutoUpdate.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2692
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\AutoUpdate.exe' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\so2game.exe' -ErrorAction SilentlyContinue; } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2q1jckfq.x2j.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2q1jckfq.x2j.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4276-25-0x00000000078C0000-0x0000000007964000-memory.dmp

Download

memory/4276-14-0x0000000006810000-0x000000000682E000-memory.dmp

Download

memory/4276-5-0x00000000061F0000-0x0000000006256000-memory.dmp

Download

memory/4276-6-0x0000000006260000-0x00000000062C6000-memory.dmp

Download

memory/4276-3-0x0000000005AC0000-0x00000000060EA000-memory.dmp

Download

memory/4276-13-0x0000000006430000-0x0000000006787000-memory.dmp

Download

memory/4276-2-0x0000000005320000-0x0000000005356000-memory.dmp

Download

memory/4276-15-0x00000000068C0000-0x000000000690C000-memory.dmp

Download

memory/4276-16-0x0000000006DE0000-0x0000000006E14000-memory.dmp

Download

memory/4276-17-0x0000000073940000-0x000000007398C000-memory.dmp

Download

memory/4276-4-0x0000000005900000-0x0000000005922000-memory.dmp

Download

memory/4276-24-0x0000000007800000-0x000000000781E000-memory.dmp

Download

memory/4276-33-0x0000000007D90000-0x0000000007DA1000-memory.dmp

Download

memory/4276-26-0x00000000081F0000-0x000000000886A000-memory.dmp

Download

memory/4276-28-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

Download

memory/4276-32-0x0000000007E20000-0x0000000007EB6000-memory.dmp

Download

memory/4276-27-0x0000000007B90000-0x0000000007BAA000-memory.dmp

Download

memory/4276-34-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

Download

memory/4276-35-0x0000000007DD0000-0x0000000007DE5000-memory.dmp

Download

memory/4276-36-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

Download

memory/4276-37-0x0000000007E10000-0x0000000007E18000-memory.dmp

Download

memory/4276-40-0x00000000058B0000-0x00000000058CF000-memory.dmp

Download

memory/4276-41-0x0000000005A50000-0x0000000005A87000-memory.dmp

Download

memory/4276-42-0x00000000058F0000-0x00000000058FA000-memory.dmp

Download