Overview

overview

8

Static

static

3

2026-05-29...er.exe

windows10-2004-x64

8

2026-05-29...er.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    29/05/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-29_11b7fb3393eaf1fa348396a4736972be_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
  • Size 40.0MB
  • Sample260529-bfzykafw3s
  • SHA256 e8d0d95077c5b582abff3fb60180d074b6e51b187b3c2c3877639bd2ab856b38
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-29_11b7fb3393eaf1fa348396a4736972be_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-29_11b7fb3393eaf1fa348396a4736972be_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_remcos_smoke-loader.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5076

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        testtta1.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoPK_CTC-AIO.VN\Config\AllUser\testtta1.cfg.download
        • Size 6KB
        • SHA256 a08e54a9a9be74008a7a9ac8559c4f2d213e2a784ef12d63f80d866a676c31c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AutoTrain2.exe.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\AutoTrain2.exe.download
        • Size 2.6MB
        • SHA256 a8661c9e95a92b8b0d1bc5b7a3c921c18713c8d184d891397bbfc49cfb9fb966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        343.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\MAPS\343.map.download
        • Size 1KB
        • SHA256 2632ea8fd471e0e8386420a63fe4ac4ed31ec4bfbb48517949c8ab52fd9ae01d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        47.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\MAPS\47.map.download
        • Size 1KB
        • SHA256 bb8e43cf40e9be53a626094711a5500831cf808246e143f911d61786b35ed70c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        587.map.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\MAPS\587.map.download
        • Size 738B
        • SHA256 eb43390aa5ede449e2f9233bfaa24dea0ec19a4bcc41fc195c94bb3b5fc97580
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        343_default.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\Profiles\343_default.cfg.download
        • Size 12KB
        • SHA256 64748d8fd48138b49257a8bdc18e896caafdae893551652492220bb5bdfbba45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        344_default.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\Profiles\344_default.cfg.download
        • Size 12KB
        • SHA256 84434abdc290acf4f1f0163c76734616b7f252e3993a9d660e9b2523fafd02b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        3254325235sda.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\UserData\3254325235sda.cfg.download
        • Size 12KB
        • SHA256 d80b470ab45c6d41531b6e179e581a3ec8c0412a927738413bf89bf0c7dab1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Mod-39Live-3903.cfg.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Auto\UserData\Mod-39Live-3903.cfg.download
        • Size 12KB
        • SHA256 2d7985c0240465b3b715a521084f7ebf8b98466a193a7358fb8e01f0d8de9407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        le.ico.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Images\le.ico.download
        • Size 16KB
        • SHA256 6c52fccdece0d39d8bf4470db546ec928f3fbf266d64f6903e2736b95710b8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlbs.ico.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Images\vlbs.ico.download
        • Size 3KB
        • SHA256 a529011bb572be01fb8eb3aa9eb71ef81107d07b07c7c80d83d5bbe7d85735eb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Vn.fon.download
        • Path C:\Users\Admin\AppData\Local\Temp\AutoTrain_CTC-AIO.VN\datafile\Vn.fon.download
        • Size 15KB
        • SHA256 c8cf8135c35f2fc8d8bef39f3c9b6abf7455119663baef74acb4c99b2a4b3562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tbRoad.txt.download
        • Path C:\Users\Admin\AppData\Local\Temp\Config\tbRoad.txt.download
        • Size 52KB
        • SHA256 962a0056f5c99e4a37dee8858e65009739f160975a87f6cfe1b5e4aba43fb590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5076-0-0x0000000006080000-0x0000000006090000-memory.dmp
        Download

        memory/5076-54-0x0000000006080000-0x0000000006090000-memory.dmp
        Download