Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
- Size 14.7MB
- Sample260707-bxveeact8k
- SHA256 5ec9d7ca26e98df4c96fb71caff95df9f029ca78ec51b10cca54811a90138097
- MD5 b0d908424f1097b303b85240c0cd1bf3
- SHA1 b4c752216c7ba3c7ae99334d435eb85e124f1a38
- SHA512 38aa30b509a599b8fd8a8d2513353cef8aa2a564586233b03569ea6b792dc249e3bde3cf5a570f28fba414f264324478c29c006a3b57f9bf22c372471af299ad
- SSDEEP 393216:MnwnKWfrbvRXw+T2WPnoY4smJ62mWC08ohD:M4JXw62oneEaD
- TLSH T132F67D21E7D64070F5B30A709976A27A8A77BE300832CC9FB24C5D4D5BB7DC2896572B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2352 files.dat 2912 setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.dat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2377119455-1173575704-3843639301-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1524 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1332 WMIC.exe 1332 WMIC.exe 1332 WMIC.exe 1332 WMIC.exe 4872 WMIC.exe 4872 WMIC.exe 4872 WMIC.exe 4872 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1332 WMIC.exe Token: SeSecurityPrivilege 1332 WMIC.exe Token: SeTakeOwnershipPrivilege 1332 WMIC.exe Token: SeLoadDriverPrivilege 1332 WMIC.exe Token: SeSystemProfilePrivilege 1332 WMIC.exe Token: SeSystemtimePrivilege 1332 WMIC.exe Token: SeProfSingleProcessPrivilege 1332 WMIC.exe Token: SeIncBasePriorityPrivilege 1332 WMIC.exe Token: SeCreatePagefilePrivilege 1332 WMIC.exe Token: SeBackupPrivilege 1332 WMIC.exe Token: SeRestorePrivilege 1332 WMIC.exe Token: SeShutdownPrivilege 1332 WMIC.exe Token: SeDebugPrivilege 1332 WMIC.exe Token: SeSystemEnvironmentPrivilege 1332 WMIC.exe Token: SeRemoteShutdownPrivilege 1332 WMIC.exe Token: SeUndockPrivilege 1332 WMIC.exe Token: SeManageVolumePrivilege 1332 WMIC.exe Token: 33 1332 WMIC.exe Token: 34 1332 WMIC.exe Token: 35 1332 WMIC.exe Token: 36 1332 WMIC.exe Token: SeIncreaseQuotaPrivilege 1332 WMIC.exe Token: SeSecurityPrivilege 1332 WMIC.exe Token: SeTakeOwnershipPrivilege 1332 WMIC.exe Token: SeLoadDriverPrivilege 1332 WMIC.exe Token: SeSystemProfilePrivilege 1332 WMIC.exe Token: SeSystemtimePrivilege 1332 WMIC.exe Token: SeProfSingleProcessPrivilege 1332 WMIC.exe Token: SeIncBasePriorityPrivilege 1332 WMIC.exe Token: SeCreatePagefilePrivilege 1332 WMIC.exe Token: SeBackupPrivilege 1332 WMIC.exe Token: SeRestorePrivilege 1332 WMIC.exe Token: SeShutdownPrivilege 1332 WMIC.exe Token: SeDebugPrivilege 1332 WMIC.exe Token: SeSystemEnvironmentPrivilege 1332 WMIC.exe Token: SeRemoteShutdownPrivilege 1332 WMIC.exe Token: SeUndockPrivilege 1332 WMIC.exe Token: SeManageVolumePrivilege 1332 WMIC.exe Token: 33 1332 WMIC.exe Token: 34 1332 WMIC.exe Token: 35 1332 WMIC.exe Token: 36 1332 WMIC.exe Token: SeIncreaseQuotaPrivilege 4872 WMIC.exe Token: SeSecurityPrivilege 4872 WMIC.exe Token: SeTakeOwnershipPrivilege 4872 WMIC.exe Token: SeLoadDriverPrivilege 4872 WMIC.exe Token: SeSystemProfilePrivilege 4872 WMIC.exe Token: SeSystemtimePrivilege 4872 WMIC.exe Token: SeProfSingleProcessPrivilege 4872 WMIC.exe Token: SeIncBasePriorityPrivilege 4872 WMIC.exe Token: SeCreatePagefilePrivilege 4872 WMIC.exe Token: SeBackupPrivilege 4872 WMIC.exe Token: SeRestorePrivilege 4872 WMIC.exe Token: SeShutdownPrivilege 4872 WMIC.exe Token: SeDebugPrivilege 4872 WMIC.exe Token: SeSystemEnvironmentPrivilege 4872 WMIC.exe Token: SeRemoteShutdownPrivilege 4872 WMIC.exe Token: SeUndockPrivilege 4872 WMIC.exe Token: SeManageVolumePrivilege 4872 WMIC.exe Token: 33 4872 WMIC.exe Token: 34 4872 WMIC.exe Token: 35 4872 WMIC.exe Token: 36 4872 WMIC.exe Token: SeIncreaseQuotaPrivilege 4872 WMIC.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 2912 setup.exe 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE 1524 OUTLOOK.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4700 wrote to memory of 5400 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 87 PID 5400 wrote to memory of 1332 5400 cmd.exe 89 PID 4700 wrote to memory of 904 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 91 PID 4700 wrote to memory of 4000 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 93 PID 4000 wrote to memory of 4872 4000 cmd.exe 95 PID 4700 wrote to memory of 2680 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 96 PID 2680 wrote to memory of 2352 2680 cmd.exe 98 PID 4700 wrote to memory of 5668 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 99 PID 4700 wrote to memory of 1524 4700 2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 101 PID 5668 wrote to memory of 2912 5668 cmd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-07-06_b0d908424f1097b303b85240c0cd1bf3_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1332
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c copy C:\Windows\system32\Tasks\OInstall "C:\Windows\Temp\OInstall.tmp" /Y2⤵PID:904
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"2⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4872
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c C:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml2⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Users\Admin\AppData\Local\Temp\files\setup.exeC:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
-
C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1524
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32_16.0.20131.20112.cab
- Size 11KB
- SHA256 7e4e35b5d63a1221a832f03e172f7897d7018a35c60f14a70c961aca53b7c427
- MD5 4502c8893ae795526d490fef4af03606
- SHA1 b206f421bededf8ba2db01b7290b2bb768ee0a7f
- SHA512 504d32fddbd847e77d7376c6d6e7193f096b2a2d7b5204a841e143fe30e8cfe832b68fc8362d879dfea5b67a1b3188911ad3e372e59d5d3244930150d0993bcc
- SSDEEP 192:5wFDqAMUzHuca8LxyQxh4FYqwNCDylrbuK/X01k9z3AgEDd+q:56HucaGAEh4FYVNCeriSR9zfEDdJ
- TLSH T1BE424AE2DA2C9082EDDB6D90D3B8EE933C3C53C70D84985256E2F5852DC77C99B2506C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OfficeC2RAB5E83C4-F30B-4E09-96E6-B058EF04B0D9\VersionDescriptor.xml
- Size 25KB
- SHA256 f0ed9ce0d540582b13db4475853514c40c23ef51d8ec814b124211a0984f14f5
- MD5 d22ac6f7aa3e7ea4fb222e4c348fe67d
- SHA1 57be82f69927080e57db6c38cf51b2085fa7910e
- SHA512 b5601c9377a3d133d1daf94cb581f9458a51429dbfbd596d1299539969b34850b0a14d50ad19249982f68c0e0446d77c3639eccca2067e7ba4bf5af212dff625
- SSDEEP 96:YBjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJVnOX:I/rZ73
- TLSH T1E0C2456BB8D03D1D413477A7E96336E2EF62826396050458F10D734B3FB285DB3AB619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
- Size 502B
- SHA256 5dd6a2cbaf3fe54e623ae8ca79cf3b4bd15871c2ea68a3ce669a854238fd1223
- MD5 057b592b8166e85054f04a76633be4b9
- SHA1 bccbf3660857aacd72fe7925800804ee10f728c2
- SHA512 41bd363e55d4e1532d961b39fa1771a6537aed57dca95a3befe5d006bf79d0ec1d1ead376f721b9c8a49fa0c86a457583690f5158af31fe4aa6735aafd4969c3
- TLSH T13AF08290EA9C2D856731513991CA6B85FD6622634D212D08B18FA64B8BFB838334701F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
- Size 707KB
- SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
- MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
- SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
- SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
- SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
- TLSH T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
- Size 5.3MB
- SHA256 49d226e1863d8467437f20a60cb60746694af08f28eeeaa83e7db4c183c9c118
- MD5 9b31e72f0d80d638a8a44ee973103835
- SHA1 29916328ccf3f72dae2eff96dbc8fed708e4ce82
- SHA512 c58d5a73d2fec10df0c0b89d9a68d476e02fc9df6f95c28769edd38d39bfb34e0504cadf68aa90b8d740df221c81be080c585d1258ad24c73136f6ed8beb6353
- SSDEEP 98304:5Bs4fOawoXZJrUQQGoPWRjB8nO7MWp6cAuRA8TTTqwY2hsAXWC:/sWOaHrbQGoPWRjBtwrcLTTqWP3
- TLSH T172466C32A7EC4435F1B20A305E7967598DFDBDB40833C48F63441A5E1AB99C3A864B6F
- MD5 SHA1 SHA512 SSDEEP TLSH