Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 12:35
General
- Target 2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe
- Size 72.4MB
- Sample260504-psep2sbx5w
- SHA256 f545f4132426251e68abf8426916b29c4123a58c6672470a505a0ef5e1929598
Malware Config
Signatures
- Detects executables packed with Enigma 3 IoCs
- Detects packed executables observed in Molerats 3 IoCs
- Loads dropped DLL 22 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_edc645de46c61d6e4dff68612982740b_darkgate_elex_gcleaner_glassworm_luca-stealer_magniber_njrat_poet-rat_remcos.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb51E5.tmp
evb51F5.tmp
evb51F6.tmp
evb5207.tmp
evb5256.tmp
evb5296.tmp
evb5381.tmp
evb53A1.tmp
evb53B2.tmp
evb546E.tmp
evb54EC.tmp
evb558A.tmp
evb558B.tmp
evb559B.tmp
evb559C.tmp
evb559D.tmp
evb559E.tmp
evb559F.tmp
evb55A0.tmp
evb55B1.tmp
evb55B2.tmp
evb55B3.tmp
memory/4480-116-0x0000000003B70000-0x0000000003B83000-memory.dmp
memory/4480-92-0x0000000003C00000-0x0000000003ED4000-memory.dmp
memory/4480-73-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-78-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-86-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/4480-91-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/4480-102-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/4480-97-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-106-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/4480-46-0x000000006910C000-0x000000006910D000-memory.dmp
memory/4480-163-0x00000000677C0000-0x000000006783B000-memory.dmp
memory/4480-166-0x0000000066CC0000-0x0000000066CD1000-memory.dmp
memory/4480-165-0x0000000003B70000-0x0000000003B83000-memory.dmp
memory/4480-164-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/4480-162-0x000000006D100000-0x000000006D17A000-memory.dmp
memory/4480-161-0x000000006B840000-0x000000006B850000-memory.dmp
memory/4480-160-0x0000000067940000-0x000000006799A000-memory.dmp
memory/4480-159-0x0000000003B90000-0x0000000003BA1000-memory.dmp
memory/4480-158-0x00000000628C0000-0x0000000062929000-memory.dmp
memory/4480-157-0x000000006EA40000-0x000000006EA53000-memory.dmp
memory/4480-156-0x000000006C800000-0x000000006C815000-memory.dmp
memory/4480-50-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-36-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/4480-37-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-39-0x000000006D400000-0x000000006D477000-memory.dmp
memory/4480-43-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-44-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-27-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/4480-28-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-19-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/4480-126-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/4480-124-0x0000000004240000-0x00000000042CD000-memory.dmp
memory/4480-123-0x0000000003B70000-0x0000000003B81000-memory.dmp
memory/4480-122-0x0000000004240000-0x00000000042C8000-memory.dmp
memory/4480-167-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/4480-121-0x0000000003B70000-0x0000000003B82000-memory.dmp
memory/4480-120-0x0000000003B70000-0x0000000003B83000-memory.dmp
memory/4480-119-0x0000000003B70000-0x0000000003BE7000-memory.dmp
memory/4480-118-0x0000000003B70000-0x0000000003B85000-memory.dmp
memory/4480-117-0x0000000003B70000-0x0000000003B88000-memory.dmp
memory/4480-0-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/4480-114-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/4480-107-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/4480-105-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-113-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/4480-16-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/4480-108-0x0000000003B70000-0x0000000003BC2000-memory.dmp
memory/4480-104-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-103-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-96-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-6-0x000000006D400000-0x000000006D477000-memory.dmp
memory/4480-51-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-90-0x0000000065A80000-0x0000000065A9C000-memory.dmp
memory/4480-10-0x000000006D400000-0x000000006D477000-memory.dmp
memory/4480-101-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-79-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-84-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-66-0x000000006E140000-0x000000006E19E000-memory.dmp
memory/4480-1-0x0000000077A94000-0x0000000077A95000-memory.dmp
memory/4480-61-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/4480-56-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/4480-168-0x00000000095B0000-0x00000000095C9000-memory.dmp
memory/4480-3-0x0000000077A95000-0x0000000077A96000-memory.dmp
memory/4480-169-0x000000006D400000-0x000000006D477000-memory.dmp
memory/4480-171-0x000000006FE40000-0x000000006FFBF000-memory.dmp
memory/4480-170-0x000000006EB40000-0x000000006EB62000-memory.dmp
memory/4480-172-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-174-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-173-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-176-0x0000000069900000-0x0000000069AC7000-memory.dmp
memory/4480-175-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-177-0x0000000000400000-0x00000000006B2000-memory.dmp
memory/4480-190-0x0000000064B40000-0x0000000064B54000-memory.dmp
memory/4480-186-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-183-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-189-0x000000006CE40000-0x000000006CE79000-memory.dmp
memory/4480-188-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-181-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-195-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-202-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-197-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-200-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-208-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-228-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-226-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-221-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-223-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-234-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-236-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-249-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-247-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-260-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-267-0x000000006AA80000-0x000000006AC63000-memory.dmp
memory/4480-265-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-262-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-275-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-273-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-286-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-288-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-301-0x0000000061B40000-0x0000000062294000-memory.dmp
memory/4480-304-0x0000000003440000-0x0000000003A68000-memory.dmp
memory/4480-299-0x0000000068A80000-0x000000006912D000-memory.dmp
memory/4480-306-0x000000006AA80000-0x000000006AC63000-memory.dmp