Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 11:52
General
- Target 2026-06-02_2758f185db0351a1930091d7829fe1fb_amadey_darkgate_glassworm_icedid_luca-stealer_njrat_qadars.exe
- Size 39.0MB
- Sample260602-n14tgact3x
- SHA256 28275221e983c5b279e4760d95e29ac6818c159d7b1b6b8589f3f6ceb7129f69
Malware Config
Signatures
- Custom signatureDetects executables manipulated with Fody 1 IoCs
- Drops file in System32 directory 16 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies registry class 35 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_2758f185db0351a1930091d7829fe1fb_amadey_darkgate_glassworm_icedid_luca-stealer_njrat_qadars.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_2758f185db0351a1930091d7829fe1fb_amadey_darkgate_glassworm_icedid_luca-stealer_njrat_qadars.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4cb2a4hm.4vc\crashpad_handler.exeC:\Users\Admin\AppData\Local\Temp\4cb2a4hm.4vc\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Local\Google\Play Games\CrashReporting\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Battlestar --annotation=ver=26.3.934.0 --initial-client-data=0x6a4,0x6a8,0x6ac,0x6a0,0x6b0,0x7ffd0061f8a0,0x7ffd0061f8b0,0x7ffd0061f8c02⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /C dir /s /-c "C:\"2⤵
-
-
C:\Windows\System32\dxdiag.exe"C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\dxdiag.log"2⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CrashReporting.dll
crashpad_handler.exe
installer_phenotype_delegate_lib.dll
recorder_delegate_lib.dll
dxdiag.log
memory/808-75-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-68-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-76-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-77-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-78-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-79-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-80-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-74-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-69-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/808-70-0x000001C1ADE50000-0x000001C1ADE51000-memory.dmp
memory/4376-21-0x00000279EE080000-0x00000279EE13A000-memory.dmp
memory/4376-53-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-12-0x00000279D2C20000-0x00000279D2C46000-memory.dmp
memory/4376-13-0x00000279ECB40000-0x00000279ECBBE000-memory.dmp
memory/4376-14-0x00000279EDCC0000-0x00000279EDDA2000-memory.dmp
memory/4376-15-0x00000279ECBC0000-0x00000279ECBD6000-memory.dmp
memory/4376-16-0x00000279D2C50000-0x00000279D2C58000-memory.dmp
memory/4376-18-0x00000279EDF70000-0x00000279EDF82000-memory.dmp
memory/4376-19-0x00000279EDF80000-0x00000279EDF8A000-memory.dmp
memory/4376-17-0x00000279EDEF0000-0x00000279EDF6A000-memory.dmp
memory/4376-20-0x00000279EDF90000-0x00000279EDFB6000-memory.dmp
memory/4376-11-0x00000279D2B90000-0x00000279D2BA0000-memory.dmp
memory/4376-37-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-38-0x00000279EE480000-0x00000279EE488000-memory.dmp
memory/4376-40-0x00000279EE4B0000-0x00000279EE4BE000-memory.dmp
memory/4376-39-0x00000279F3420000-0x00000279F3458000-memory.dmp
memory/4376-41-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-42-0x00000279F40A0000-0x00000279F4116000-memory.dmp
memory/4376-47-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-8-0x00000279D1320000-0x00000279D1328000-memory.dmp
memory/4376-54-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-55-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-56-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-57-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-65-0x00000279F4520000-0x00000279F4526000-memory.dmp
memory/4376-66-0x00000279F4540000-0x00000279F4548000-memory.dmp
memory/4376-10-0x00000279D2BC0000-0x00000279D2C20000-memory.dmp
memory/4376-9-0x00000279D1340000-0x00000279D134A000-memory.dmp
memory/4376-7-0x00000279D2B70000-0x00000279D2B86000-memory.dmp
memory/4376-6-0x00000279ED940000-0x00000279EDABC000-memory.dmp
memory/4376-5-0x00000279D12F0000-0x00000279D131A000-memory.dmp
memory/4376-4-0x00000279D12E0000-0x00000279D12EA000-memory.dmp
memory/4376-3-0x00000279D12D0000-0x00000279D12DA000-memory.dmp
memory/4376-2-0x00000279ECC40000-0x00000279ED08C000-memory.dmp
memory/4376-1-0x00000279D12C0000-0x00000279D12D0000-memory.dmp
memory/4376-0-0x00000279D05A0000-0x00000279D0EAA000-memory.dmp
memory/4376-67-0x00000279F45B0000-0x00000279F45F6000-memory.dmp