Overview

overview

7

Static

static

3

2026-05-18...at.exe

windows10-2004-x64

7

2026-05-18...at.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/05/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
  • Size 27.7MB
  • Sample260518-e5yzcabw6r
  • SHA256 3596dec82eb91db8fb8b3bcdee51519a13cd462d25e0cd2e3db80a88edcde1e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 4 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-18_be33540038a92fbf632984d8c841a3bb_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_magniber_njrat.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3540
    • C:\Program Files (x86)\CuEyes\CuEyes.exe
      "C:\Program Files (x86)\CuEyes\CuEyes.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1856
  • C:\Program Files (x86)\CuEyes\CuEyes.exe
    "C:\Program Files (x86)\CuEyes\CuEyes.exe" /auto
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Program Files (x86)\CuEyes\CuEyes.exe
      "C:\Program Files (x86)\CuEyes\CuEyes.exe" --type=renderer --disable-gpu-compositing --no-sandbox --lang=en-US --lang=en-US --log-file="C:\Users\Admin\AppData\Local\CuEyes\Cef.log" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="4188.0.1772565806\41817437" /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:416
    • C:\Program Files (x86)\CuEyes\CuEyes.exe
      "C:\Program Files (x86)\CuEyes\CuEyes.exe" --type=utility --channel="4188.1.1958613545\2104573147" --lang=en-US --no-sandbox --no-sandbox --lang=en-US --log-file="C:\Users\Admin\AppData\Local\CuEyes\Cef.log" /prefetch:8
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        CuEyes.exe
        • Path C:\Program Files (x86)\CuEyes\CuEyes.exe
        • Size 2.2MB
        • SHA256 c94a9f22f0ab01822b5f2ecc95aa1f291d51dac35853411cde7f3fd478601068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef.pak
        • Path C:\Program Files (x86)\CuEyes\cef.pak
        • Size 2.2MB
        • SHA256 2b630beda09733863ee28d74a15da7644ce303120e1ac91a500077f00564ddd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_100_percent.pak
        • Path C:\Program Files (x86)\CuEyes\cef_100_percent.pak
        • Size 141KB
        • SHA256 58f7ce00d589aaaebfaf3d0badac45924545e49f2d1531156f282eac7abb11b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cef_extensions.pak
        • Path C:\Program Files (x86)\CuEyes\cef_extensions.pak
        • Size 4.1MB
        • SHA256 221a97daf8263321ceb9ce244452fc97b865b561e399b23d42682fef4785ea7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        func_helper.dll
        • Path C:\Program Files (x86)\CuEyes\func_helper.dll
        • Size 128KB
        • SHA256 4df2a156c8d1ff0b729be8eb692e549342fe5a611a32e6cab8159c692ab0f415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Program Files (x86)\CuEyes\icudtl.dat
        • Size 9.7MB
        • SHA256 2857fbe46d007307b1e204c6eb1b7e4988973b958ec8edb07445988f332c1ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcef.dll
        • Path C:\Program Files (x86)\CuEyes\libcef.dll
        • Size 47.4MB
        • SHA256 bd8ce1462637fbd7fcfaa4969231d01ea917a59fe493f4a9c641e7c7e2c1d34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcurl.dll
        • Path C:\Program Files (x86)\CuEyes\libcurl.dll
        • Size 3.0MB
        • SHA256 0156ae258929ab47d94f8e4a7632f72aafd63944529475cab064abe7fc4f4f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Program Files (x86)\CuEyes\locales\en-US.pak
        • Size 39KB
        • SHA256 a76263a6b5c969a0b0a2cc90bdb86d35f3adaddef41884fa84832c24b0940192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        natives_blob.bin
        • Path C:\Program Files (x86)\CuEyes\natives_blob.bin
        • Size 402KB
        • SHA256 7d9c0c4d88618bdd16bb0681fdec1dd736e2ed1141ae527a27b22fb93f27848f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snapshot_blob.bin
        • Path C:\Program Files (x86)\CuEyes\snapshot_blob.bin
        • Size 474KB
        • SHA256 2073cac4abbb76eaf0693b8c15cd117638b8b046f4bad2938e7226084048ded4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wzstat.dll
        • Path C:\Program Files (x86)\CuEyes\wzstat.dll
        • Size 407KB
        • SHA256 ee049ad61b8251a00e678a15c110192f77c667d74c74c4b6603d851700ac58be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cfg.ini
        • Path C:\Users\Admin\AppData\Local\CuEyes\cfg.ini
        • Size 329B
        • SHA256 178debb15055f3d1edffc5559fd52dac2d7613db3912ba6cb9f037538c0f644e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cfg.ini
        • Path C:\Users\Admin\AppData\Local\CuEyes\cfg.ini
        • Size 376B
        • SHA256 61c368d4749d1ae6b4a2016896e15bfeeb3414d1a353429c7d3bfec321150e65
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CuEyes.lnk
        • Path C:\Users\Admin\Desktop\CuEyes.lnk
        • Size 1KB
        • SHA256 11234a2540bda3a1b17ac27e3ff15672102c854338fbc69644ce308ac6d68ac7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        CuEyes.lnk~RFe585aae.TMP
        • Path C:\Users\Admin\Desktop\CuEyes.lnk~RFe585aae.TMP
        • Size 1KB
        • SHA256 e577bb28badf43f09e980dd3b06a96f0248f88007e1d71705cd34e159096aaad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/416-439-0x000000003D100000-0x000000003D101000-memory.dmp
        Download

        memory/416-471-0x0000000020100000-0x0000000020101000-memory.dmp
        Download

        memory/3540-0-0x0000000000BF0000-0x00000000027A7000-memory.dmp
        Download