Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
28/06/2026, 20:14
General
- Target 2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
- Size 1.7MB
- Sample260628-yz75lsd12m
- SHA256 03a3650cffb2e2d1f0e766038698690722f1cfd9f575246de2e8c5a7cfbf29e3
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 32 IoCs
- Program crash 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"2⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"4⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a03ccfd98ad83acb9519e623b433bc10_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"5⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 4366⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 4366⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 4965⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 4965⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 4964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 5324⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 5203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 5203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 4522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 5602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2804 -ip 28041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2804 -ip 28041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5820 -ip 58201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5820 -ip 58201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1392 -ip 13921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1392 -ip 13921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1396 -ip 13961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1396 -ip 13961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3168 -ip 31681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3168 -ip 31681⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RCX1768.tmp
RCX727C.tmp
RCXFE33.tmp
pUc11D2.tmp
pUc11F4.tmp
pUc1798.tmp
pUc17BA.tmp
pUc1E35.tmp
pUc1E96.tmp
pUc26D6.tmp
pUc4370.tmp
pUc4392.tmp
pUc49A0.tmp
pUc49D2.tmp
pUc5644.tmp
pUc5695.tmp
pUc5715.tmp
pUc5737.tmp
pUc5798.tmp
pUc6B39.tmp
pUcC02.tmp
pUcFE44.tmp
memory/1392-189-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/1396-213-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/2804-136-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/2804-64-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/2804-102-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/3168-230-0x0000000000400000-0x00000000005B6000-memory.dmp
memory/5820-186-0x0000000000400000-0x00000000005B6000-memory.dmp