Overview

overview

8

Static

static

3

2026-05-17...er.exe

windows10-2004-x64

8

2026-05-17...er.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    154s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    17/05/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-17_0e103bd98595ede12410db26900cbf67_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
  • Size 16.4MB
  • Sample260517-3rm7padx3x
  • SHA256 d83f677494ea261e0ed16b22c4117558219e5e24f872a530e27e84ce628a8824
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_0e103bd98595ede12410db26900cbf67_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_0e103bd98595ede12410db26900cbf67_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        testtta1.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoKeoXeCTC\Config\AllUser\testtta1.cfg.download
        • Size 6KB
        • SHA256 a08e54a9a9be74008a7a9ac8559c4f2d213e2a784ef12d63f80d866a676c31c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AutoTrain2.exe.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\AutoTrain2.exe.download
        • Size 4.6MB
        • SHA256 07b6cc279e237cbbe9391f22195d4d7337d2a1cc1d12804b6484720b1a76bdc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        343.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\MAPS\343.map.download
        • Size 1KB
        • SHA256 2632ea8fd471e0e8386420a63fe4ac4ed31ec4bfbb48517949c8ab52fd9ae01d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        47.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\MAPS\47.map.download
        • Size 1KB
        • SHA256 bb8e43cf40e9be53a626094711a5500831cf808246e143f911d61786b35ed70c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        587.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\MAPS\587.map.download
        • Size 738B
        • SHA256 eb43390aa5ede449e2f9233bfaa24dea0ec19a4bcc41fc195c94bb3b5fc97580
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        343_default.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\Profiles\343_default.cfg.download
        • Size 12KB
        • SHA256 64748d8fd48138b49257a8bdc18e896caafdae893551652492220bb5bdfbba45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        344_default.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\Profiles\344_default.cfg.download
        • Size 12KB
        • SHA256 84434abdc290acf4f1f0163c76734616b7f252e3993a9d660e9b2523fafd02b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3254325235sda.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\UserData\3254325235sda.cfg.download
        • Size 12KB
        • SHA256 d80b470ab45c6d41531b6e179e581a3ec8c0412a927738413bf89bf0c7dab1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Mod-39Live-3903.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\UserData\Mod-39Live-3903.cfg.download
        • Size 12KB
        • SHA256 2d7985c0240465b3b715a521084f7ebf8b98466a193a7358fb8e01f0d8de9407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        autovlbs.exe .download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_jxctc2005.net\datafile\Auto\autovlbs.exe .download
        • Size 224KB
        • SHA256 22526e9ec4d764c67bac7cca0a3598817df20e09d46184b902d29415a72d72e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1936-0-0x00000000046D0000-0x00000000046E0000-memory.dmp
        Download

        memory/1936-2-0x00000000046D0000-0x00000000046E0000-memory.dmp
        Download