Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
01/07/2026, 22:24
General
- Target 2026-07-01_38281b334d502902745dccd3770fd35f_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe
- Size 21.0MB
- Sample260701-2bf8rsft9l
- SHA256 415f53889fd65ad6ebdee3b3cb0a8f471fbb40a3106bb603a0c2b96fa972df44
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_38281b334d502902745dccd3770fd35f_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_38281b334d502902745dccd3770fd35f_amadey_darkgate_elex_glassworm_hammertoss_icedid_luca-stealer_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2320-0-0x0000000074E72000-0x0000000074E73000-memory.dmp
memory/2320-1-0x00000000006D0000-0x0000000001BD2000-memory.dmp
memory/2320-2-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2320-3-0x0000000004100000-0x000000000410A000-memory.dmp
memory/2320-4-0x0000000004110000-0x0000000004118000-memory.dmp
memory/2320-5-0x00000000066D0000-0x00000000066F6000-memory.dmp
memory/2320-6-0x0000000008260000-0x000000000881A000-memory.dmp
memory/2320-7-0x0000000007D80000-0x0000000007E12000-memory.dmp
memory/2320-8-0x0000000007E40000-0x0000000007EF4000-memory.dmp
memory/2320-9-0x0000000007F70000-0x0000000007F92000-memory.dmp
memory/2320-10-0x0000000008820000-0x0000000008B7B000-memory.dmp
memory/2320-14-0x0000000008210000-0x000000000822C000-memory.dmp
memory/2320-15-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2320-16-0x0000000074E60000-0x000000007561C000-memory.dmp
memory/2320-17-0x000000000CCD0000-0x000000000CCD8000-memory.dmp
memory/2320-18-0x000000000CD50000-0x000000000CD8E000-memory.dmp
memory/2320-19-0x000000000CD20000-0x000000000CD2E000-memory.dmp
memory/2320-20-0x0000000074E72000-0x0000000074E73000-memory.dmp
memory/2320-21-0x0000000074E60000-0x000000007561C000-memory.dmp