Overview

overview

9

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

9

2026-06-30...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    137s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 02:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_d3924e2301ed9526058517ff320b45da_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
  • Size 9.6MB
  • Sample260701-c4rsjaex21
  • SHA256 b65dd789ee05614f28a029f0f89aa52c0a30a34aee7d77839fdedf4ce8e0b64a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoverypersistenceransomwarespywareupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 17 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_d3924e2301ed9526058517ff320b45da_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_d3924e2301ed9526058517ff320b45da_amadey_darkgate_elex_emotet_glassworm_icedid_luca-stealer_njrat_remcos_vidar.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Windows\SysWOW64\diskusage.exe
      C:\Windows\SysWOW64\diskusage.exe
      2⤵
        PID:5568
      • C:\Windows\SysWOW64\LaunchWinApp.exe
        C:\Windows\SysWOW64\LaunchWinApp.exe
        2⤵
          PID:2092
        • C:\Windows\SysWOW64\ReAgentc.exe
          C:\Windows\SysWOW64\ReAgentc.exe
          2⤵
            PID:5332
          • C:\Windows\SysWOW64\Robocopy.exe
            C:\Windows\SysWOW64\Robocopy.exe
            2⤵
              PID:1920
            • C:\Windows\SysWOW64\RpcPing.exe
              C:\Windows\SysWOW64\RpcPing.exe
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2672
            • C:\Windows\SysWOW64\relog.exe
              C:\Windows\SysWOW64\relog.exe
              2⤵
                PID:1144
              • C:\Windows\SysWOW64\replace.exe
                C:\Windows\SysWOW64\replace.exe
                2⤵
                  PID:5912
                • C:\Windows\SysWOW64\chkdsk.exe
                  C:\Windows\SysWOW64\chkdsk.exe
                  2⤵
                    PID:5680
                  • C:\Windows\SysWOW64\cmdl32.exe
                    C:\Windows\SysWOW64\cmdl32.exe
                    2⤵
                      PID:1444
                    • C:\Windows\SysWOW64\iscsicpl.exe
                      C:\Windows\SysWOW64\iscsicpl.exe
                      2⤵
                        PID:4396
                      • C:\Windows\SysWOW64\Fondue.exe
                        C:\Windows\SysWOW64\Fondue.exe
                        2⤵
                          PID:696
                        • C:\Windows\SysWOW64\recover.exe
                          C:\Windows\SysWOW64\recover.exe
                          2⤵
                            PID:5852
                          • C:\Windows\SysWOW64\cliconfg.exe
                            C:\Windows\SysWOW64\cliconfg.exe
                            2⤵
                              PID:1936
                            • C:\Windows\SysWOW64\regedit.exe
                              C:\Windows\SysWOW64\regedit.exe
                              2⤵
                              • Runs regedit.exe
                              PID:4248
                            • C:\Windows\SysWOW64\RdpSa.exe
                              C:\Windows\SysWOW64\RdpSa.exe
                              2⤵
                                PID:3820
                              • C:\Windows\SysWOW64\dllhost.exe
                                C:\Windows\SysWOW64\dllhost.exe
                                2⤵
                                  PID:3748
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\SysWOW64\cmd.exe
                                  2⤵
                                    PID:3560
                                  • C:\Windows\SysWOW64\bthudtask.exe
                                    C:\Windows\SysWOW64\bthudtask.exe
                                    2⤵
                                      PID:3556
                                    • C:\Windows\SysWOW64\MuiUnattend.exe
                                      C:\Windows\SysWOW64\MuiUnattend.exe
                                      2⤵
                                        PID:5512
                                      • C:\Windows\SysWOW64\PkgMgr.exe
                                        C:\Windows\SysWOW64\PkgMgr.exe
                                        2⤵
                                          PID:4900
                                        • C:\Windows\SysWOW64\OposHost.exe
                                          C:\Windows\SysWOW64\OposHost.exe
                                          2⤵
                                            PID:5992
                                          • C:\Windows\SysWOW64\ByteCodeGenerator.exe
                                            C:\Windows\SysWOW64\ByteCodeGenerator.exe
                                            2⤵
                                              PID:4716
                                            • C:\Windows\SysWOW64\subst.exe
                                              C:\Windows\SysWOW64\subst.exe
                                              2⤵
                                                PID:4188
                                              • C:\Windows\SysWOW64\mmc.exe
                                                C:\Windows\SysWOW64\mmc.exe
                                                2⤵
                                                  PID:4084
                                                • C:\Windows\SysWOW64\net1.exe
                                                  C:\Windows\SysWOW64\net1.exe
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4992
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                1⤵
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:4588
                                                • C:\Windows\explorer.exe
                                                  explorer.exe /LOADSAVEDWINDOWS
                                                  2⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4256
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5972
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1204
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                1⤵
                                                  PID:3168

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      prep_Activatable Class_Hermes_perf.cache
                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                      • Size 599B
                                                      • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      nNKbo.log
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nNKbo.log
                                                      • Size 9.6MB
                                                      • SHA256 1b0d6ed38ba2c07b4afc7a2df3a03b27d82470bea5b8729c3450106f084a18a9
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      loldsb.ini
                                                      • Path C:\loldsb.ini
                                                      • Size 218B
                                                      • SHA256 fc165cfff728ced9768813c1f19ba6e45de45907ad297216382975e769ac689c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      memory/1204-272-0x0000019603C60000-0x0000019603F1C000-memory.dmp
                                                      Download

                                                      memory/2456-14-0x0000000004280000-0x0000000004AE4000-memory.dmp
                                                      Download

                                                      memory/2456-13-0x0000000004280000-0x0000000004AE4000-memory.dmp
                                                      Download

                                                      memory/2456-16-0x0000000004F70000-0x00000000057D4000-memory.dmp
                                                      Download

                                                      memory/2456-20-0x0000000004F70000-0x00000000057D4000-memory.dmp
                                                      Download

                                                      memory/2456-25-0x0000000004F70000-0x00000000057D4000-memory.dmp
                                                      Download

                                                      memory/2456-24-0x0000000002E80000-0x0000000002EA7000-memory.dmp
                                                      Download

                                                      memory/2456-26-0x0000000004F70000-0x00000000057D4000-memory.dmp
                                                      Download

                                                      memory/2456-27-0x0000000002E80000-0x0000000002EA7000-memory.dmp
                                                      Download

                                                      memory/2456-15-0x0000000002D10000-0x0000000002D37000-memory.dmp
                                                      Download

                                                      memory/2456-70-0x0000000002D10000-0x0000000002D37000-memory.dmp
                                                      Download

                                                      memory/2456-69-0x0000000004F70000-0x00000000057D4000-memory.dmp
                                                      Download

                                                      memory/2456-12-0x0000000002D10000-0x0000000002D37000-memory.dmp
                                                      Download

                                                      memory/2456-4-0x0000000004280000-0x0000000004AE4000-memory.dmp
                                                      Download

                                                      memory/2456-72-0x0000000002E80000-0x0000000002EA7000-memory.dmp
                                                      Download

                                                      memory/2456-0-0x0000000010000000-0x00000000101BC000-memory.dmp
                                                      Download

                                                      memory/2456-71-0x0000000004280000-0x0000000004AE4000-memory.dmp
                                                      Download

                                                      memory/4256-271-0x000000000EC70000-0x000000000ED3C000-memory.dmp
                                                      Download

                                                      memory/4992-59-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/4992-62-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/4992-58-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/4992-57-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/4992-73-0x0000000004520000-0x0000000004D84000-memory.dmp
                                                      Download

                                                      memory/4992-77-0x0000000003150000-0x0000000003177000-memory.dmp
                                                      Download

                                                      memory/4992-78-0x0000000005210000-0x0000000005A74000-memory.dmp
                                                      Download

                                                      memory/4992-80-0x0000000005210000-0x0000000005A74000-memory.dmp
                                                      Download

                                                      memory/4992-84-0x00000000031A0000-0x00000000031C7000-memory.dmp
                                                      Download

                                                      memory/4992-67-0x0000000004520000-0x0000000004D84000-memory.dmp
                                                      Download

                                                      memory/4992-63-0x0000000010000000-0x00000000101BC000-memory.dmp
                                                      Download

                                                      memory/4992-56-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/4992-61-0x0000000000400000-0x0000000000DCF000-memory.dmp
                                                      Download

                                                      memory/5972-114-0x0000018F03B90000-0x0000018F03C90000-memory.dmp
                                                      Download

                                                      memory/5972-139-0x0000018F039D0000-0x0000018F039F0000-memory.dmp
                                                      Download

                                                      memory/5972-113-0x0000018F03770000-0x0000018F03790000-memory.dmp
                                                      Download

                                                      memory/5972-107-0x0000018F00020000-0x0000018F00120000-memory.dmp
                                                      Download

                                                      memory/5972-153-0x0000018F14450000-0x0000018F14470000-memory.dmp
                                                      Download