Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 01:19
General
- Target 2026-07-02_8d99abfd57ef87e5d8392d4bd477acfb_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
- Size 2.7MB
- Sample260703-bpvefaev5l
- SHA256 a203d6d46b47eff00b13d3d2f93906fbf6e3afabb97ac0faeae6f362f95250bd
Score
9/10
Malware Config
Signatures
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d99abfd57ef87e5d8392d4bd477acfb_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_8d99abfd57ef87e5d8392d4bd477acfb_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\finder_uninst.exe"C:\Users\Admin\AppData\Local\Temp\finder_uninst.exe" --p=explorer.exe2⤵
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
finder_uninst.exe
memory/2336-0-0x0000000010000000-0x0000000010061000-memory.dmp
memory/4760-9-0x0000000010000000-0x0000000010061000-memory.dmp
memory/4760-15-0x0000000003300000-0x000000000350C000-memory.dmp
memory/4760-23-0x0000000003250000-0x0000000003260000-memory.dmp
memory/4760-24-0x0000000003250000-0x0000000003260000-memory.dmp