Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe
- Size 1.8MB
- Sample260703-dc91gaaw4x
- SHA256 14f59c611c1e8d2f7d5a165a17c9279642ef2983c6488098bdc1d13a32989294
- MD5 7c484077a42cc0fefc4ab4b5c707c0b4
- SHA1 e6177c2deeb817332b57081175c7a7f9a0c64896
- SHA512 c9227fa9b831acf1ad8743d429f426e27147fc467ea1f3a6bd062eb21e7e77eb1ccc835ad100344b6b343ab719cf9d7dac5d14b9b6c28fb749cdf8e5eea700d7
- SSDEEP 49152:GDkpzzy53w24gQu3TPZ2psFkiSqwozci1:GDkpzzyFQgZqsFki+ozci1
- TLSH T17985011175E18A31E1BF153049F58AB55A7BBC300F716BCB1390BE2D3E31982DA297A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5432 microsoftedgeupdatesetup32.exe 1332 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_tt.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\psmachine.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\psmachine_arm64.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\psuser_64.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_hu.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_lt.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_mr.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ro.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_tr.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\NOTICE.TXT microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\MicrosoftEdgeUpdateCore.exe microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_bg.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_en-GB.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_iw.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_lv.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_pt-BR.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ur.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_bn.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_es-419.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_hi.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ml.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_sv.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_uk.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_gl.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_kk.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_da.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_hr.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_is.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_th.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_af.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_nn.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_nb.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_sl.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_as.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_gd.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_lb.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_mt.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ne.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\EdgeUpdate.dat microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_fr.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_bn-IN.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_bs.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_quz.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\MicrosoftEdgeUpdateSetup.exe microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\MicrosoftEdgeComRegisterShellARM64.exe microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_el.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_or.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_sr-Cyrl-BA.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdate.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\psmachine_64.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ca.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_cs.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_en.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_fil.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ja.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_az.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ru.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_es.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_te.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ga.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_ka.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_km.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_mk.dll microsoftedgeupdatesetup32.exe File created C:\Program Files (x86)\Microsoft\Temp\EUAE6B.tmp\msedgeupdateres_sr-Latn-RS.dll microsoftedgeupdatesetup32.exe - Program crash 1 IoCs
pid pid_target Process procid_target 248 1332 WerFault.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsoftedgeupdatesetup32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1332 eventviewer.exe 1332 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3948 wrote to memory of 5432 3948 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe 88 PID 3948 wrote to memory of 1332 3948 2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_7c484077a42cc0fefc4ab4b5c707c0b4_amadey_darkgate_elex_emotet_hellokitty_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatesetup32.exe"microsoftedgeupdatesetup32.exe "2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5432
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 15883⤵
- Program crash
PID:248
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1332 -ip 13321⤵PID:5688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
- Size 65KB
- SHA256 1eb26f22a27a440374998445506fcc4a1e34ef66fd1013aba19dcc38b84d2860
- MD5 82737989c55aa7aad05bef7a6ff074c1
- SHA1 9a645f485f0a9b8bb99d1ca539aa8c043fe39dfc
- SHA512 36f8cacb818e1fe701d5b41ffdd0a5e0f72ec98415b11f8c10d5e774faf7dec859da524adaea96e0f5612bc732d0e8bcf588aafba8ec0248f886f79097e9396a
- SSDEEP 1536:Ko/dFPHAEi33hsJ7PBIaa5oC8D+e9i3UDSwQBjVgN:p/kAtIamhe9i3BjVgN
- TLSH T19A633DA89F77F264AD4A8E6A4EEED69612E551D51E01031F0E307EB42F43AA7FF57000
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 808B
- SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
- MD5 878e958d6bff424e59d1feb51584a01f
- SHA1 b11261559bbea40f1874448196e2934277a537e9
- SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
- TLSH T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
- Size 701B
- SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
- MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
- SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
- SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
- TLSH T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
- Size 246B
- SHA256 325b365cd98cd4d9df94c8cfae23a860d50cd21da4fc8f54e44f85ce9daa1696
- MD5 d154639c7b3897de6f24dae2a3f35f44
- SHA1 0b67c0bf6306af04771286abdbf29fbbddcc02ab
- SHA512 c711c57a808a1da3c80e02c306b235c4ab262abef6f7abd60dfcd5690bfb71bef534dd1274eb5052a57cc8c3ffb3bd2b81896ec21e51b0b3d7b332ae0677ef7c
- TLSH T150D023390B570711F17A033545E50169D7701607D4534FCD1F17800C4978E1F1C52C2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 a541f5bfdef05b425e5fe09d5c8a439a5ff80a261f806cdf79c4ccec0506fdee
- MD5 17931d4476a53addf306df6733a1a016
- SHA1 2682a0710c58f6c2a9622721cc26e871d3705d11
- SHA512 e7e489dd21127c2a2015af8252f0ab111fedef2e96668544dd8cc5b4defa2ac12f652f755d748f175d2b25c332b55c74ca1c4f39dffc52e52579ae6bcf82e136
- TLSH T173C08C1C9AA21A06F2A8437D02D17A039B209101E2418F051AF92A08CD96B1A3838C2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 83bc6c961908644dfc5d27cb308c78bd0c952fdf0f19bf878b7ed2a06a37c00b
- MD5 0e2f2377523e7d94a841e316ddc94fe5
- SHA1 0ce5dfd3b4658ab4e82b7a6d09a7082776dbd003
- SHA512 c982df36a4005b4944c2db91b5638f3d986703945a9bbefbf75feb7d2a1b0489d28bd0c8d7e4ad04f9a5459de39dee055772b384c6525695870b5b11744cb59e
- TLSH T1D9E0C2113BA80218E5730A3C7A7364485937B327AE01CACD0734008D0C24F918836719
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 fd6f52c902362f0b738ed93f3db68ed0b65edab14d63f9253be3f05844a6fe44
- MD5 084ee4c03df7a81a556e75f2bed47063
- SHA1 b249d9becde5ea290400701c787c15bd60517438
- SHA512 e01fc3f0b1ff1c0917d3ba4855dfc9337198d5ffaca25d93f934d671f294b55b59254006f94c419d0fb92865f9b95950b7f53a1ca37488bc21f892e2aae66b9f
- TLSH T116C08C2C06610A06F2A983BA02C229838A208110F3819F0126B26A48CD24F162838C29
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\microsoftedgeupdatesetup32.exe
- Size 1.5MB
- SHA256 a86d9f7c545953074b8b9c18474e953db73a9ba8e9ca50cbb3e5d97a7347fe4d
- MD5 71b072f0a3d4b9e580a8bcd523403d43
- SHA1 06bac910ad59cfa7ef323096d2c6728496b5e995
- SHA512 8e668cb63d2b2092c81c8ef8e5eeacc01a34cc8b1eb7959bdd6104337a9a491650e41412dedbc5dca620320223694902d99d4213c95fed90799b262799a6a554
- SSDEEP 24576:dwy53G70SeiN9YqxCCg83udcWXDYajPF2410wuRpGfFki94qSe/wsNfzUT:Cy53w24gQu3TPZ2psFkiSqwozi
- TLSH T1F275121175E18031F6B72A3058F5CAB12E3EBC710BB169DB23825D2D4A719D2D738BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH