Analysis
- max time kernel
149s - max time network
120s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 12:35
General
- Target 2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe
- Size 72.4MB
- Sample260504-psep2sbx5w
- SHA256 f545f4132426251e68abf8426916b29c4123a58c6672470a505a0ef5e1929598
Malware Config
Signatures
- Detects executables packed with Enigma 3 IoCs
- Detects packed executables observed in Molerats 3 IoCs
- Loads dropped DLL 22 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb17F9.tmp
evb1809.tmp
evb180A.tmp
evb181B.tmp
evb18B8.tmp
evb1907.tmp
evb1A22.tmp
evb1A61.tmp
evb1A72.tmp
evb1B8C.tmp
evb1B9D.tmp
evb1C3A.tmp
evb1C4A.tmp
evb1C4B.tmp
evb1C4C.tmp
evb1C4D.tmp
evb1C4E.tmp
evb1C5F.tmp
evb1C60.tmp
evb1C61.tmp
evb1C62.tmp
evb1C63.tmp
memory/5040-125-0x0000000004110000-0x0000000004123000-memory.dmp
memory/5040-109-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-62-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-7-0x0000000077013000-0x0000000077014000-memory.dmp
memory/5040-57-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-79-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/5040-56-0x000000006910C000-0x000000006910D000-memory.dmp
memory/5040-50-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-86-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-92-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-104-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/5040-52-0x000000006D400000-0x000000006D477000-memory.dmp
memory/5040-114-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/5040-116-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-48-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/5040-165-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/5040-177-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/5040-176-0x00000000677C0000-0x000000006783B000-memory.dmp
memory/5040-175-0x0000000066CC0000-0x0000000066CD1000-memory.dmp
memory/5040-174-0x000000006D100000-0x000000006D17A000-memory.dmp
memory/5040-173-0x000000006B840000-0x000000006B850000-memory.dmp
memory/5040-172-0x0000000067940000-0x000000006799A000-memory.dmp
memory/5040-171-0x0000000004130000-0x0000000004141000-memory.dmp
memory/5040-170-0x00000000628C0000-0x0000000062929000-memory.dmp
memory/5040-169-0x000000006EA40000-0x000000006EA53000-memory.dmp
memory/5040-168-0x000000006C800000-0x000000006C815000-memory.dmp
memory/5040-167-0x0000000004110000-0x0000000004123000-memory.dmp
memory/5040-166-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/5040-164-0x000000006D400000-0x000000006D477000-memory.dmp
memory/5040-178-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-8-0x0000000077013000-0x0000000077014000-memory.dmp
memory/5040-9-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-10-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-11-0x0000000077013000-0x0000000077014000-memory.dmp
memory/5040-41-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-39-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-38-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/5040-29-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/5040-21-0x000000006D400000-0x000000006D477000-memory.dmp
memory/5040-132-0x0000000004110000-0x0000000004121000-memory.dmp
memory/5040-131-0x0000000004A70000-0x0000000004AF8000-memory.dmp
memory/5040-130-0x0000000004110000-0x0000000004122000-memory.dmp
memory/5040-129-0x0000000004110000-0x0000000004123000-memory.dmp
memory/5040-128-0x0000000004A70000-0x0000000004AE7000-memory.dmp
memory/5040-127-0x0000000004110000-0x0000000004125000-memory.dmp
memory/5040-113-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-12-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-123-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/5040-121-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/5040-13-0x0000000077013000-0x0000000077014000-memory.dmp
memory/5040-117-0x0000000004110000-0x0000000004162000-memory.dmp
memory/5040-133-0x0000000004A70000-0x0000000004AFD000-memory.dmp
memory/5040-115-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-126-0x0000000004110000-0x0000000004128000-memory.dmp
memory/5040-105-0x0000000004180000-0x0000000004454000-memory.dmp
memory/5040-0-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/5040-97-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-49-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/5040-103-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/5040-99-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/5040-91-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/5040-74-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/5040-73-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/5040-63-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-6-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-5-0x0000000077013000-0x0000000077014000-memory.dmp
memory/5040-4-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-3-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-2-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-1-0x0000000077012000-0x0000000077013000-memory.dmp
memory/5040-179-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/5040-181-0x00000000051C0000-0x00000000051D9000-memory.dmp
memory/5040-180-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-182-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-183-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-184-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/5040-185-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/5040-186-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-187-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-188-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-189-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/5040-201-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-194-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-196-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-192-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/5040-191-0x000000006D400000-0x000000006D477000-memory.dmp
memory/5040-190-0x0000000000AD0000-0x0000000000B8F000-memory.dmp
memory/5040-199-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-208-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-215-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-210-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-213-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-222-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-224-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-229-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-236-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-241-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-243-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-238-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-250-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-252-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-264-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-266-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-285-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-280-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-294-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-292-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-306-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-308-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-322-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/5040-327-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/5040-325-0x0000000003790000-0x0000000003DB8000-memory.dmp
memory/5040-320-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/5040-334-0x0000000068A80000-0x000000006912D000-memory.dmp