Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 16:15
General
- Target 2026-05-11_eee060302ae2dbe1d7502cff7fb7074a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
- Size 2.6MB
- Sample260511-tqdgeset2w
- SHA256 5d66d19e7429cd359f0312d9747c23dc14deb88175a698c1a4d77f8f4c73082d
Malware Config
Signatures
- Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
- Detects MilleniumRAT stealer 1 IoCs
- Custom signatureDetect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Custom signatureDetects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Custom signatureDetects executables containing possible sandbox analysis VM names 1 IoCs
- Custom signatureDetects executables containing possible sandbox analysis VM usernames 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_eee060302ae2dbe1d7502cff7fb7074a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_eee060302ae2dbe1d7502cff7fb7074a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\mQSCpVJ2rvkmGyHj\svchost.exe"C:\Users\Admin\AppData\Roaming\mQSCpVJ2rvkmGyHj\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\mQSCpVJ2rvkmGyHj\svchost.exeC:\Users\Admin\AppData\Roaming\mQSCpVJ2rvkmGyHj\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_exipgrvs.1lz.ps1
svchost.exe
memory/3692-21-0x000000006FA40000-0x000000006FA8C000-memory.dmp
memory/3692-32-0x00000000071F0000-0x000000000720A000-memory.dmp
memory/3692-8-0x0000000005190000-0x00000000051F6000-memory.dmp
memory/3692-17-0x0000000005A50000-0x0000000005DA4000-memory.dmp
memory/3692-18-0x0000000005EA0000-0x0000000005EBE000-memory.dmp
memory/3692-19-0x0000000005EE0000-0x0000000005F2C000-memory.dmp
memory/3692-20-0x00000000070A0000-0x00000000070D2000-memory.dmp
memory/3692-29-0x0000000006480000-0x000000000649E000-memory.dmp
memory/3692-7-0x0000000004EF0000-0x0000000004F12000-memory.dmp
memory/3692-30-0x00000000070E0000-0x0000000007183000-memory.dmp
memory/3692-31-0x0000000007830000-0x0000000007EAA000-memory.dmp
memory/3692-9-0x0000000005200000-0x0000000005266000-memory.dmp
memory/3692-33-0x0000000007260000-0x000000000726A000-memory.dmp
memory/3692-34-0x0000000007470000-0x0000000007506000-memory.dmp
memory/3692-35-0x00000000073E0000-0x00000000073F1000-memory.dmp
memory/3692-36-0x0000000007410000-0x000000000741E000-memory.dmp
memory/3692-37-0x0000000007420000-0x0000000007434000-memory.dmp
memory/3692-38-0x0000000007510000-0x000000000752A000-memory.dmp
memory/3692-39-0x0000000007450000-0x0000000007458000-memory.dmp
memory/3692-6-0x00000000052C0000-0x00000000058E8000-memory.dmp
memory/3692-5-0x0000000002560000-0x0000000002596000-memory.dmp
memory/6112-50-0x0000000005670000-0x00000000059C4000-memory.dmp
memory/6112-52-0x000000006FA40000-0x000000006FA8C000-memory.dmp