6605274fc1c1063221ebc79022372a1c0a09ca65a23145cb0964daf804808874

General

Target
2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 5.9MB
Sample260602-ctys4ac13j
SHA256 6605274fc1c1063221ebc79022372a1c0a09ca65a23145cb0964daf804808874
MD5 5a5b4bef6fed40ee76bcae3abbab55e3
SHA1 4fbb0accd96210c669e5169a58fbec2566f6c3f8
SHA512 8dc0102ecf905083c8feaced0fb588acb99ea3d1c6b156f949e231c8b900013169e93a755fc9b14ea0ace31d1742406119272d13d4581229b53d382b856adcb4
SSDEEP 49152:ZNGCXhk3hXKM0MfGt1NNNRNNNyM/TO98VChBtzysUVap/Uo/TO98VChBtzysUVaI:ehEXSbtzysiDbtzysiSNX
TLSH
T1B356BE00AFA16836FD2685750DEA23664038FD31F39205DF9393F61E57619F22A3739A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/3016-9-0x0000000010000000-0x00000000100FC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Downloads MZ/PE file 2 IoCs

flow	pid	Process
1	4456	2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
1	4456	2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Executes dropped EXE 3 IoCs

pid	Process
3016	BDSubWiz.exe
4976	vviiqs.exe
2672	z4456.exe

Loads dropped DLL 2 IoCs

pid	Process
3016	BDSubWiz.exe
4976	vviiqs.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z4456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vviiqs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDSubWiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2156	cmd.exe
568	PING.EXE
2260	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
568	PING.EXE
2260	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3016	BDSubWiz.exe
3016	BDSubWiz.exe
4976	vviiqs.exe
4976	vviiqs.exe
4436	svchost.exe
4436	svchost.exe
4436	svchost.exe
4436	svchost.exe
1248	dllhost.exe
1248	dllhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3016	4456	2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe	80
PID 4976 wrote to memory of 4436	4976	vviiqs.exe	82
PID 4976 wrote to memory of 4436	4976	vviiqs.exe	82
PID 4436 wrote to memory of 1248	4436	svchost.exe	84
PID 4436 wrote to memory of 1248	4436	svchost.exe	84
PID 4456 wrote to memory of 2156	4456	2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe	85
PID 2156 wrote to memory of 568	2156	cmd.exe	87
PID 2156 wrote to memory of 2260	2156	cmd.exe	88
PID 2156 wrote to memory of 2672	2156	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
  "C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-06-02_5a5b4bef6fed40ee76bcae3abbab55e3_amadey_darkgate_elex_" && cd /d "C:\Users\Admin\Downloads\" && ping 127.0.0.1 -n 2 >nul && "C:\Users\Admin\Downloads\z4456.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2156
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:568
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2260
- - C:\Users\Admin\Downloads\z4456.exe
    "C:\Users\Admin\Downloads\z4456.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2672

C:\Users\Public\Documents\Tencent\QQGame\9.0\vviiq\vviiqs.exe
C:\Users\Public\Documents\Tencent\QQGame\9.0\vviiq\vviiqs.exe -svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe -k netsvcs
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe" -ks
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDSubWiz.exe

Path C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
Size 912KB
SHA256 84184943ae6d94b547885764b0f361e9dd9d74a517ad10621b1ef3d0eecf6702
MD5 a1b7601ff2db87b599149b2b00ff64de
SHA1 27f6dd3e46a769f650840cf42ce94e2b66a55abc
SHA512 f02fe55d61a879105ce49f8113c619278b36cd60d3981df685c7e132ee9c4ae782d43139af89624be145bf5de8a68b28420e8b5b8f4aee8b21c5a37993bfccfa
SSDEEP 24576:yE/TOVq28VC9ruYau/7y/kwbiJ4Rap0+C1c:J/TO98VChBtzysUVap/Uc
TLSH
T1D6159F2175C1A037F57301328FBD962D451CB8220B15AADBB3E8172D9B69AF13E3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dat
Size 1.3MB
SHA256 9aa7b997237b2493c126ccd7f46812e6e9286082c163bff36835f911c2e95a22
MD5 f3afd7e5c28050a4bc02af42dd347591
SHA1 7903df96c41ae2e6f6b78c0fd419fd1a0153b8d3
SHA512 d3a3b241809afad4ffda31af2e6242eec5497eea2b04008f46e927a250d62c5eb12a90b0b4628698874a5c446661e1438221442765f9338dfd12543b2d4c2742
SSDEEP 24576:SjXo/0uqMJfG5DUn8HCm1NNNRNNNTFG181oBmeL2wuLsahyxO:+M0MfGt1NNNRNNNyQ
TLSH
T1A8555B82CE627905FE2CD5B90D8627A24474EAB9F2C605DC4513F40FA7B4C7B112B6EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dll

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dll
Size 216KB
SHA256 b42be80d369d01900b78fa470cdb475324cbefeca8f7f1eab2929cf67377972e
MD5 11716a166cc4c87b9841efda8738c35b
SHA1 e53bd9184754e2acb561dc6f47af658331a58797
SHA512 ee1d1ae77b2225322acd7dab604c12902eee02879a0dcad25a66bb3ebb182b5483818cdc28a046a73a8b5dc56be5c13941625fbb7e4038878c0ec251559d9bec
SSDEEP 3072:Wjn82SSYc0leSm8ArKuT+O7R9W6lVZ1Gvm8P8u:X9cH3l+YdfZN8
TLSH
T13024E145A751DFB3F542473548F78725EA39D2220B823ADB6DD60124AF023ED4EB374A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3016-8-0x0000000002D70000-0x0000000002EBC000-memory.dmp

Download

memory/3016-9-0x0000000010000000-0x00000000100FC000-memory.dmp

Download

memory/3016-45-0x00000000009F0000-0x0000000000AD6000-memory.dmp

Download

memory/3016-46-0x0000000075420000-0x0000000075454000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads