Overview

overview

7

Static

static

3

2026-06-28...er.exe

windows10-2004-x64

7

2026-06-28...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_5a7bb1a50dab44a2a27d7f4b1563338b_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
  • Size 1.8MB
  • Sample260628-2b647ags8r
  • SHA256 e8f8c862ac059a674c6dd46d7aa9575d58e91a744e744d7b23367abb5becf4ab
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a7bb1a50dab44a2a27d7f4b1563338b_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a7bb1a50dab44a2a27d7f4b1563338b_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a7bb1a50dab44a2a27d7f4b1563338b_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a7bb1a50dab44a2a27d7f4b1563338b_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 468
        3⤵
        • Program crash
        PID:3520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 468
        3⤵
        • Program crash
        PID:2380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 528
      2⤵
      • Program crash
      PID:2404
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 564
      2⤵
      • Program crash
      PID:3960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2680 -ip 2680
    1⤵
      PID:3140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2680 -ip 2680
      1⤵
        PID:2184
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1340 -ip 1340
        1⤵
          PID:3748
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1340 -ip 1340
          1⤵
            PID:3776

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX100A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX100A.tmp
                • Size 4.4MB
                • SHA256 f376d57e2fdd243ad0d76d781e2b80038856b777cd9ed0a0329743dd909a720d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX101B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX101B.tmp
                • Size 4.5MB
                • SHA256 e26b0698636578b634bc88cef6c476d0f49aa46854d4b48f827fc2c7c71d24b5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX30AD.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX30AD.tmp
                • Size 1.7MB
                • SHA256 49130157dfee8d6f1ae6778f81dd8a79b32e1e1bcf1b590b70f983cb503ae758
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCXF5A8.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCXF5A8.tmp
                • Size 1.8MB
                • SHA256 93f4283893c6d45ec040ca1a7e67f0644862ff2dc8681069f91d55f4c72c6551
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1BE.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1BE.tmp
                • Size 567KB
                • SHA256 005776776a036a1ea436309db77bb8f9531df35cc2b54cf0c2862b1308ae7a1e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc1E38.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc1E38.tmp
                • Size 3.7MB
                • SHA256 223d6559af2a59063e83cc211e533a14a98f2644f58b0e8c54d585b01b03f673
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2407.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2407.tmp
                • Size 363KB
                • SHA256 fb736d4bf6b3c7e3596181b5d7b59b2df751729d96223877bbde6e28ce9a2f5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc241A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc241A.tmp
                • Size 996KB
                • SHA256 2f2e97eb1a57791769f9bf954e5dccd19d3838a82771b42215bfeaff82a7d16c
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc244C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc244C.tmp
                • Size 601KB
                • SHA256 0e45164b9fcf997cc7a1556d5250341c1bbf3403c2704ece8a62c740ae6bc890
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc245F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc245F.tmp
                • Size 514KB
                • SHA256 56acc463a7211b733d36477d23c933058d118558f5f826dca4c33fac282bdd8b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2471.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2471.tmp
                • Size 894KB
                • SHA256 f0560f41b600d92b0bea4505399812c0e5fb1c34f2e52f64de67fe2a7477f568
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2E48.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2E48.tmp
                • Size 412KB
                • SHA256 23d6894b9600e0f11685dfff9a6acc6a43c7da47a043d8d47c34d3d4c390bed9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2E5A.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2E5A.tmp
                • Size 469KB
                • SHA256 8cbee7998bd0e04a20d52ebf8a952e56e3efe98cecd19d69f4e758380fdc78c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2E9C.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2E9C.tmp
                • Size 393KB
                • SHA256 5032cba1fa73c03e7c01f4017514ea5c3c461f2a9b47af6926f574dc5b87e9fc
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2ED1.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2ED1.tmp
                • Size 1.7MB
                • SHA256 e35e253b97cd6fd376ea63ca655c15e3ede999477edc7584681539670ffafc52
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2F8F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2F8F.tmp
                • Size 566KB
                • SHA256 c0926b64c0b95f5b783c7430f4bbd2aec41f74b696c81e804641f410db253e48
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2FA2.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2FA2.tmp
                • Size 469KB
                • SHA256 41fa8b69b9d47f4e283cf681f3136d8f8f18bf4f420da4bd65ebc832a123d658
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc2FB5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc2FB5.tmp
                • Size 1.3MB
                • SHA256 3d9b2858864b2499960ec00f4a8ffbf6ad48d4573957971ffc373e92efaa1fd2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc3A56.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc3A56.tmp
                • Size 1.8MB
                • SHA256 27be052112c2457438de4dab08492e1e0d6ca9b9d1db9784a45817b50b7d063d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcED.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcED.tmp
                • Size 1.7MB
                • SHA256 62dfa555f33fb47c70fe573af0df1dc1686006c678a92bce5b31e507ad42dcde
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF306.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF306.tmp
                • Size 878KB
                • SHA256 3ae8d11f5f3cb9a7be9549a6ee97d090b2e9ee01f11128b09e37210730639049
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF3CD.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF3CD.tmp
                • Size 2.4MB
                • SHA256 8806e8a7814fe23d0cdb73b7b49c922d12a8a753c9a89346a9a93a8434cf6a88
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF3F0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF3F0.tmp
                • Size 610KB
                • SHA256 756f9aa44e50b8596a704fc6fff86ff6012b36f0943a00a8e2f2dae5787d9ab6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF412.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF412.tmp
                • Size 376KB
                • SHA256 932614508268a37e6ac2625149251d4656fc142d1671472c2b26c87429079444
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUcF4A4.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUcF4A4.tmp
                • Size 688KB
                • SHA256 c42e88d5aabad2907b6aff5cc77d38ff3a5f0b3573a215dd44d96c4c5f7ac4eb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1340-156-0x0000000000400000-0x00000000005D2000-memory.dmp
                Download

                memory/1340-370-0x0000000000400000-0x00000000005D2000-memory.dmp
                Download

                memory/2680-96-0x0000000000400000-0x00000000005D2000-memory.dmp
                Download