Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:36
Behavioral task
behavioral1
Sample
2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe
- Size 6.1MB
- Sample260707-e8dgtahy8y
- SHA256 818c7f821193952b809fddf423b571dc3882e5fb2ea00fe769361aaa1aec832f
- MD5 2f9f0fa10a44b1838f697b3fbeda2a7a
- SHA1 a520b67122c0fbb452379a27fdb749a748982ea0
- SHA512 7711da84dddea6dec8d882e3a9de8a01f603ce6149b4c887eb0f8f4d81318df5da417335b9c8abbbae8487573300257c987e30fc07c9170b26aca6659b16b03f
- SSDEEP 98304:OwkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0/INQy1Sb:RJEul4szEonqcaQh
- TLSH T10A567B327C86C179E251407149ACAFB5C19DA8364B7204CB7BC46F3A9A613C77E31F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Shodi worm 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5e8-11.dat family_shodi - Executes dropped EXE 1 IoCs
pid Process 2460 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usa - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification C:\Windows\SysWOW64\UsaShohdi.asu 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\uninstall.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Mozilla Firefox\updater.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javacpl.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\bin\jconsole.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Java\jdk-1.8\jre\bin\javacpl.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSOHTMED.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\private_browsing.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Java\jre-1.8\bin\javaw.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\misc.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\msoasb.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File created \??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usa - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 708 wrote to memory of 2460 708 2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usaC:\Users\Admin\AppData\Local\Temp\2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usa2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2460
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usa
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_2f9f0fa10a44b1838f697b3fbeda2a7a_akira_amadey_coinminer_darkgate_elex_luca-stealer_njrat_.usa
- Size 781KB
- SHA256 2ad0dedcda48a899960f06b90b0fb9d08c83fef416f616ce359340fce4886eb4
- MD5 c9f853de1e78fc0dedfed88e35f127f8
- SHA1 36da03865c8337aab2f4bfac4b2195554e84a0e4
- SHA512 c1ace7f8e72af4929d4e1804882889b4e6e8cc60b616680412695ef259bc2ccd61d6040d92ef31f3a8a214e55ca66c0468823074b330fd1dd32428e0a5eb71f9
- SSDEEP 24576:R2zEYytjjqNSlhvpfQiIhKPtehfQwr9qySkbged:RPtjtQiIhUyQy1SkFd
- TLSH T115059E12B592C033E0A211B15578AB769DBEBD340B3195DB67C80A5D4F346C2AF36B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\UsaShohdi.asu
- Size 6.1MB
- SHA256 6d533a170b4141e0f6670b9ea0af6128e5121002f0e7d1d15a282f4c4cde1c42
- MD5 c8a841e3a7ca0b4ad7c3b13505fcd3e1
- SHA1 270a55738467ef4ddee1c0581e17156a18bc58b5
- SHA512 7da7dd69bb6828f7191c19b823c31aefb6135bd5e072510bd825935b555254659c822d40e75002b01c8fb69b79ea63da864285d7ad1fb64ef41f0e35495ef71f
- SSDEEP 98304:EwkB/qoHMdnJE7hAlKnsz2C2PYdhIqHpnq0/INQy1Sb:DJEul4szEonqcaQh
- TLSH T120567B327C86C179E251407149ACAFB5C19DA8364B7204CB7BC46F3A9A613C77E31F6A
- MD5 SHA1 SHA512 SSDEEP TLSH