c4f5f833dae2c30d82d158e3d3d52d8b224977c69a7c95fdc3ab63ac0fcdd83b

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
Size 1.8MB
Sample260528-cpy83aft5s
SHA256 c4f5f833dae2c30d82d158e3d3d52d8b224977c69a7c95fdc3ab63ac0fcdd83b
MD5 8020c584d058b23d52fe359058faacb0
SHA1 3d85db98db4ac904444cfe7adc7b67606897d0e6
SHA512 b112a58aec7981d101600e070998e3d1b43cfa89f563361cc012ff2ef3fd1d82f10cf61c95bd1067793d4c03a0470512894a5bcb7477f951f7d1c2f3a4962206
SSDEEP 49152:GDkpzzy53w24gQu3TPZ2psFkiSqwozcif:GDkpzzyFQgZqsFki+ozcif
TLSH
T14885011175E18A31E1BF153049F58AB55A7BBC300F716BCB1390BE2D3E31982DA297A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2636	microsoftedgeupdatesetup32.exe
3436	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_gd.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdateOnDemand.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\psuser.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_it.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ru.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_as.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_nn.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_fa.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ro.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_kok.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_mt.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_or.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_gu.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_lv.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ur.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdate.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeComRegisterShellARM64.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_kn.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_nl.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_pt-BR.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_sv.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_mk.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_sr-Latn-RS.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ca.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_et.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_iw.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_mr.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_pt-PT.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_pa.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ug.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdateCore.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_es-419.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdateSetup.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_da.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_hu.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_tr.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_lb.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdateBroker.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_am.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_is.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_lt.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_bn-IN.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_kk.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_lo.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\MicrosoftEdgeUpdate.exe	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\psmachine_64.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\psmachine_arm64.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\EdgeUpdate.dat	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_cs.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_en-GB.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_es.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_hi.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\psuser_64.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_hr.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ms.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_nb.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_pl.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_sl.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ta.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_zh-CN.dll	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\NOTICE.TXT	microsoftedgeupdatesetup32.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1393.tmp\msedgeupdateres_ar.dll	microsoftedgeupdatesetup32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2060	3436	WerFault.exe	82
1668	2396	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsoftedgeupdatesetup32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3436	eventviewer.exe
3436	eventviewer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2636	2396	2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe	81
PID 2396 wrote to memory of 3436	2396	2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_8020c584d058b23d52fe359058faacb0_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatesetup32.exe
  "microsoftedgeupdatesetup32.exe "
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2636
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 2104
    3⤵
    - Program crash
    PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1356
  2⤵
  - Program crash
  PID:1668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3436 -ip 3436
1⤵
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2396 -ip 2396
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94C33D778ADC562180302FF1B77EFF1A
Size 219KB
SHA256 ca1fbd713bdd5e25935c9730a7d3aaac2f57693ce87417c80a80977469dbee63
MD5 556b137b6d8a754d3f1f07c9044cf0fc
SHA1 4a5d2b13bdabdc3c24510468d4baab87edfe7f8c
SHA512 4ed868bbde391cc0900db9732552f541bc91a617519a9272811d2eb2ca443b62eed1155525aa6d7226cde2a3911489d89141aecf6d92a7d080a1dd23b2d26f54
SSDEEP 3072:5lOqHpRG6D1xv1XsfQXFJeb27hEgtQk9IMBBKDNt:5lrpf91rJtH+MBIv
TLSH
T15524182C6C77F561BDA98E524DEDEA9663E7BDF61621030F0E346E502C03A9BCB1B405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94C33D778ADC562180302FF1B77EFF1A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94C33D778ADC562180302FF1B77EFF1A
Size 246B
SHA256 1e685e3fe888dc2d2e53840db9b6c9be7a96335b8c01b1cfcca5633c2cb92263
MD5 0d74245a017ceb4bbcaec3bad067aa92
SHA1 8951d9b72894620c4d9feca4b8ad3ebb53f4ca83
SHA512 9b7154c6a217f20f7f5a77b51ace99d626ec896647f448df86e9de2a3b2b23bdc7910e6a73229232acedb85bd48200fe9f1d46fe48fde29ab2beb8ab190be1b1
TLSH
T1F6D012391F262396F1FCE1F9C8E14E869D715422B9B14B552166570C6C33F611C52D0C
MD5 SHA1 SHA512 TLSH

Submit Download

microsoftedgeupdatesetup32.exe

Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatesetup32.exe
Size 1.5MB
SHA256 a86d9f7c545953074b8b9c18474e953db73a9ba8e9ca50cbb3e5d97a7347fe4d
MD5 71b072f0a3d4b9e580a8bcd523403d43
SHA1 06bac910ad59cfa7ef323096d2c6728496b5e995
SHA512 8e668cb63d2b2092c81c8ef8e5eeacc01a34cc8b1eb7959bdd6104337a9a491650e41412dedbc5dca620320223694902d99d4213c95fed90799b262799a6a554
SSDEEP 24576:dwy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUT:Cy53w24gQu3TPZ2psFkiSqwozi
TLSH
T1F275121175E18031F6B72A3058F5CAB12E3EBC710BB169DB23825D2D4A719D2D738BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download