Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 06:40
General
- Target 2026-05-31_92cbdc9123df5f8d67f3de484848c40e_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 9.6MB
- Sample260531-he7eksa18v
- SHA256 16fdaed845fcc583f17460739fb64949c0b5568c86916ea0bc0a2e3eefb91e26
Malware Config
Signatures
- UPX dump on OEP (original entry point) 18 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_92cbdc9123df5f8d67f3de484848c40e_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_92cbdc9123df5f8d67f3de484848c40e_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\esentutl.exeC:\Windows\SysWOW64\esentutl.exe2⤵
-
-
C:\Windows\SysWOW64\eudcedit.exeC:\Windows\SysWOW64\eudcedit.exe2⤵
-
-
C:\Windows\SysWOW64\finger.exeC:\Windows\SysWOW64\finger.exe2⤵
-
-
C:\Windows\SysWOW64\sdchange.exeC:\Windows\SysWOW64\sdchange.exe2⤵
-
-
C:\Windows\SysWOW64\RMActivate_ssp_isv.exeC:\Windows\SysWOW64\RMActivate_ssp_isv.exe2⤵
-
-
C:\Windows\SysWOW64\auditpol.exeC:\Windows\SysWOW64\auditpol.exe2⤵
-
-
C:\Windows\SysWOW64\Fondue.exeC:\Windows\SysWOW64\Fondue.exe2⤵
-
-
C:\Windows\SysWOW64\tar.exeC:\Windows\SysWOW64\tar.exe2⤵
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
-
-
C:\Windows\SysWOW64\cttune.exeC:\Windows\SysWOW64\cttune.exe2⤵
-
-
C:\Windows\SysWOW64\eudcedit.exeC:\Windows\SysWOW64\eudcedit.exe2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeC:\Windows\SysWOW64\schtasks.exe2⤵
-
-
C:\Windows\SysWOW64\ieUnatt.exeC:\Windows\SysWOW64\ieUnatt.exe2⤵
-
-
C:\Windows\SysWOW64\cacls.exeC:\Windows\SysWOW64\cacls.exe2⤵
-
-
C:\Windows\SysWOW64\setup16.exeC:\Windows\SysWOW64\setup16.exe2⤵
-
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\SysWOW64\appidtel.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
puySb.log
loldsb.ini
memory/2704-24-0x0000000002F10000-0x0000000002F37000-memory.dmp
memory/2704-25-0x00000000044A0000-0x0000000004D04000-memory.dmp
memory/2704-14-0x0000000002EB0000-0x0000000002ED7000-memory.dmp
memory/2704-15-0x0000000002EB0000-0x0000000002ED7000-memory.dmp
memory/2704-16-0x00000000044A0000-0x0000000004D04000-memory.dmp
memory/2704-20-0x00000000044A0000-0x0000000004D04000-memory.dmp
memory/2704-60-0x0000000002EB0000-0x0000000002ED7000-memory.dmp
memory/2704-13-0x00000000037B0000-0x0000000004014000-memory.dmp
memory/2704-26-0x0000000002F10000-0x0000000002F37000-memory.dmp
memory/2704-12-0x00000000037B0000-0x0000000004014000-memory.dmp
memory/2704-43-0x00000000037B0000-0x0000000004014000-memory.dmp
memory/2704-4-0x00000000037B0000-0x0000000004014000-memory.dmp
memory/2704-59-0x00000000037B0000-0x0000000004014000-memory.dmp
memory/2704-61-0x0000000002F10000-0x0000000002F37000-memory.dmp
memory/2704-2-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/2704-58-0x00000000044A0000-0x0000000004D04000-memory.dmp
memory/3444-50-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-51-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-49-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-53-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-54-0x0000000010000000-0x00000000101BC000-memory.dmp
memory/3444-47-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-62-0x0000000003E30000-0x0000000004694000-memory.dmp
memory/3444-66-0x0000000003E30000-0x0000000004694000-memory.dmp
memory/3444-69-0x00000000032F0000-0x0000000003317000-memory.dmp
memory/3444-70-0x0000000004B20000-0x0000000005384000-memory.dmp
memory/3444-73-0x0000000004B20000-0x0000000005384000-memory.dmp
memory/3444-76-0x0000000003370000-0x0000000003397000-memory.dmp
memory/3444-48-0x0000000000400000-0x0000000000DCF000-memory.dmp
memory/3444-79-0x0000000003E30000-0x0000000004694000-memory.dmp