723a9d5a784cec6cc66dc43bbdffe2681f0bad391e735e6c3322eab1911817a4

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 14:55

Target
2026-07-09_382761ef1edf4fb0c88d42e1ab1601db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Size 7.8MB
Sample260709-sapdbads9y
SHA256 723a9d5a784cec6cc66dc43bbdffe2681f0bad391e735e6c3322eab1911817a4
MD5 382761ef1edf4fb0c88d42e1ab1601db
SHA1 585ba0bf7ea639dea29941c1412dd424a28f831a
SHA512 b9fb01e4fe31930a684a7cff0137db1991d9185d248585171e4ae1bb4c548cb256a983f2f9d0b2c321016fb1664ebf0383681667630ff2454731f6079ead6813
SSDEEP 98304:MeRLZpNct/Ujn6LdxYkPXo+GOKkT3JkLoEL78woli84/q21Zh3DLLAoxZUIB0em:HZpNctMj6LdxYf63JXKod4DZnL1Uww
TLSH
T181869E20E711D02BF8E300B1D67D57AE5558AB30035504DBB3CC6E9E6BB5AD2BB32A17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
1544	netsh.exe
3236	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_382761ef1edf4fb0c88d42e1ab1601db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTcbPrivilege	3764	2026-07-09_382761ef1edf4fb0c88d42e1ab1601db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 1544	3764	2026-07-09_382761ef1edf4fb0c88d42e1ab1601db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe	88
PID 3764 wrote to memory of 3236	3764	2026-07-09_382761ef1edf4fb0c88d42e1ab1601db_amadey_darkgate_elex_glassworm_luca-stealer_lynx_njrat_smoke-loader.exe	90