Overview

overview

7

Static

static

3

2026-06-30...er.exe

windows10-2004-x64

7

2026-06-30...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 03:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_b6b8663ca94d3ec57c5c5cd77208980c_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
  • Size 1.7MB
  • Sample260701-dp2jvse181
  • SHA256 29d08d93d8081bd1f458e0cf586376a24125d7ea84c9882e26b2e7ce708a2901
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 13 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_b6b8663ca94d3ec57c5c5cd77208980c_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_b6b8663ca94d3ec57c5c5cd77208980c_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\2026-06-30_b6b8663ca94d3ec57c5c5cd77208980c_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-30_b6b8663ca94d3ec57c5c5cd77208980c_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 476
        3⤵
        • Program crash
        PID:3192
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 512
        3⤵
        • Program crash
        PID:1900
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 564
      2⤵
      • Program crash
      PID:3564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 564
      2⤵
      • Program crash
      PID:5996
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1076 -ip 1076
    1⤵
      PID:6076
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1076 -ip 1076
      1⤵
        PID:688
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5520 -ip 5520
        1⤵
          PID:2780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5520 -ip 5520
          1⤵
            PID:5784

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                pUc54B3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc54B3.tmp
                • Size 843KB
                • SHA256 1802cbf2870abced8e43c12ce145b3b1dd8fada648ec3ae761d5d4b0ad8bff85
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc54C5.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc54C5.tmp
                • Size 816KB
                • SHA256 7deb18535031de25983a10f43c4e8d3ad8b7cd3d29de19f947d00a0440a6a04b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc550D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc550D.tmp
                • Size 282KB
                • SHA256 024ffcbb0a7521573027e360da617dfa778af4e07cb94940efc35fc1f6a10759
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc552F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc552F.tmp
                • Size 2.4MB
                • SHA256 d2d4f1dff157cca1a8ab0e0b4129184151cf04c0d603824d05af0f9d9e88aa62
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5542.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5542.tmp
                • Size 549KB
                • SHA256 f533525c61c928be243345a81bd17022a635f466577c0e57796869a450adcc80
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5554.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5554.tmp
                • Size 315KB
                • SHA256 79e194234e95f3287e59398cef7b4625c1f8d244a22058312c13505eb40b9acb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc5599.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc5599.tmp
                • Size 627KB
                • SHA256 2cd0390fcd692627acc4d8f7a731379b13c6263508619ccf9d76669e33969f16
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1076-90-0x0000000000400000-0x00000000005C3000-memory.dmp
                Download

                memory/5520-93-0x0000000000400000-0x00000000005C3000-memory.dmp
                Download