c9dbba79e2e2f4510c2de2cdb88c0803f9aa9739143ce2a7b2a2f2e510f03817

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Size 1.9MB
Sample260531-rt744aat4s
SHA256 c9dbba79e2e2f4510c2de2cdb88c0803f9aa9739143ce2a7b2a2f2e510f03817
MD5 08b765e2047cb63356dc409f94926306
SHA1 05585db37e884ce2a190419f0c64c953eb373c8e
SHA512 65e264381d03f90840ab12a08de544df50ce1b094d8552f7e4f854a90347b0e312ebbd90c5af6439fb6202d9a98358e6945be25a1541b49b95a628373a1f79c7
SSDEEP 49152:lEt/msRIUnAJWDwp0ekTxLa+hvZT5OgD18rkeE1Px3Wqx4MM1:lEVmsHKW0p0ekYI18ye
TLSH
T1F9959E11B7C280B1D5D205B232AEBFBA59796F300B3594C793C43DA98A70DD1763AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4580	2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
4580	2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
4580	2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
4580	2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_08b765e2047cb63356dc409f94926306_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads