Overview

overview

7

Static

static

3

2026-06-26...op.exe

windows10-2004-x64

7

2026-06-26...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 16:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_49980331d55323a8f36aea70fc782a2a_darkgate_elex_rhadamanthys_stealc_stop.exe
  • Size 9.5MB
  • Sample260629-tt2cnabs4p
  • SHA256 157df3d4dfdff6d8cdb42d2c60486927b45c0c93d6611db3f4ed63878cc8177e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_49980331d55323a8f36aea70fc782a2a_darkgate_elex_rhadamanthys_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_49980331d55323a8f36aea70fc782a2a_darkgate_elex_rhadamanthys_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Users\Admin\AppData\Local\Temp\2026-06-26_49980331d55323a8f36aea70fc782a2a_darkgate_elex_rhadamanthys_stealc_stop.exe
      /i "C:\Users\Admin\AppData\Roaming\金盈\金盈证劵数据终端-旗舰版\install\0931D4E\BoYiSetup.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\2026-06-26_49980331d55323a8f36aea70fc782a2a_darkgate_elex_rhadamanthys_stealc_stop.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4356
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5528
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding FB2D11D2E93C68D6D1C80E31E7C09AD6 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSIB2C1.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIB2C1.tmp
        • Size 48KB
        • SHA256 99f4e00b6908057a2fe5067ff6c8b6e32b5c07558ab79139dc4b998f1da4b517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BoYiSetup.msi
        • Path C:\Users\Admin\AppData\Roaming\金盈\金盈证劵数据终端-旗舰版\install\0931D4E\BoYiSetup.msi
        • Size 713KB
        • SHA256 b667f11707a9efecedf106076457e94e4b9240668a5205fe2deaaed25b301329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        decoder.dll
        • Path C:\Users\Admin\AppData\Roaming\金盈\金盈证劵数据终端-旗舰版\install\decoder.dll
        • Size 105KB
        • SHA256 5fcd0aab311b1cc51c4af4a7cd089b7c557671b7744b66fc55d65b6fcd8305f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4164-0-0x00000000024B0000-0x00000000024B1000-memory.dmp
        Download

        memory/4164-117-0x00000000024B0000-0x00000000024B1000-memory.dmp
        Download