Overview

overview

7

Static

static

3

2026-07-11...er.exe

windows10-2004-x64

7

2026-07-11...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_071f7188de08a5bf367ed7b4d950f56a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
  • Size 1.7MB
  • Sample260711-raqqpsct7n
  • SHA256 52503d25ea89a69ddd90e68e45a5c47aea2000eef307d6991e6fd0a04ef7490c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 42 IoCs
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_071f7188de08a5bf367ed7b4d950f56a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_071f7188de08a5bf367ed7b4d950f56a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\2026-07-11_071f7188de08a5bf367ed7b4d950f56a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-11_071f7188de08a5bf367ed7b4d950f56a_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 472
        3⤵
        • Program crash
        PID:5096
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5800 -s 472
        3⤵
        • Program crash
        PID:3152
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 512
      2⤵
      • Program crash
      PID:5920
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1464 -s 512
      2⤵
      • Program crash
      PID:1752
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1464 -ip 1464
    1⤵
      PID:4100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5800 -ip 5800
      1⤵
        PID:3668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5800 -ip 5800
        1⤵
          PID:4812
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1464 -ip 1464
          1⤵
            PID:1816

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                RCX9813.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX9813.tmp
                • Size 1.7MB
                • SHA256 4d8c961d9d68defdf3a1c45fafc7f5df11303b37cb6781f3837e3e5ac2d59735
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX9E22.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX9E22.tmp
                • Size 6.3MB
                • SHA256 013260639fc9e0040fc070a4d26b65941f272bb443889420b33322b554ecf5ea
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX9E32.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX9E32.tmp
                • Size 6.3MB
                • SHA256 ca627ad984e463300aeb9abe762f9976aa7c3c76d65bf43f634df19a1238f1c9
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                RCX9F17.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\RCX9F17.tmp
                • Size 1.8MB
                • SHA256 f5f396b6720c7ddf77fbce8d27e6be4431b44c07e8e0daa5a1482d16214d5578
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9689.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9689.tmp
                • Size 790KB
                • SHA256 56de0378e3d4c15bf3260a96844b449b71f8562179ff88ca89f55f6743582a11
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc96F3.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc96F3.tmp
                • Size 2.4MB
                • SHA256 ef6c2ed89402dbe83c26b3d122b8bca6ab27098484b43f7a8ce72de91420c87d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9706.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9706.tmp
                • Size 523KB
                • SHA256 1ef2a214e5af230df2051ba3aa833e031e91d66a04b7a612bb2eb7e4ef487075
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9718.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9718.tmp
                • Size 289KB
                • SHA256 dee51124d5fef072f56acf9ad2613c4837fc8b09fa2ce6d62c792dfaec274e4d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc974D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc974D.tmp
                • Size 600KB
                • SHA256 7388d9e4abd01b457b561768490a6d4bf8d65faffdc52c7255c938398efc0535
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9888.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9888.tmp
                • Size 499KB
                • SHA256 173db9ac06dd6aeb6117709bd1ed9918ae2058a1c44936c70f625054fa91fd91
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc989B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc989B.tmp
                • Size 338KB
                • SHA256 94e9f5da764338626b77f08e2167710dbeb402759b818738635828838c9db3a3
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc98CF.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc98CF.tmp
                • Size 297KB
                • SHA256 a70f3b706b5f5b799f4e9827a0041990e19c625b45e4066d60e25af926694941
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc994F.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc994F.tmp
                • Size 305KB
                • SHA256 6132ad2e84d8343d911d8af36ceb9acae2afd759e7e8aa5511a34b4d9105ddfd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9972.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9972.tmp
                • Size 301KB
                • SHA256 b92c3951d96ca0a78833545b764cf07ed527f30c376ddf7ac2e236096ad4059e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9A04.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9A04.tmp
                • Size 1.7MB
                • SHA256 8268ee41701716bee16a14791de0e7a546fcf98a5fc22d5c162c10a01d474ec8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9A39.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9A39.tmp
                • Size 3.7MB
                • SHA256 4ca4e8a922500f3aeadee242420025f2f0d9c63b15045f78c4a7463c9f7a4fa0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9A7B.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9A7B.tmp
                • Size 2.5MB
                • SHA256 a0bb970a28a1721710f2211cc56847c7fb95ff107032129958082a24be00cfad
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9A9D.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9A9D.tmp
                • Size 1.9MB
                • SHA256 5fa37d66e451fb8e4d2df11477cbbdd28538d42cc485637900d83a91fa06a653
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                pUc9AB0.tmp
                • Path C:\Users\Admin\AppData\Local\Temp\pUc9AB0.tmp
                • Size 2.1MB
                • SHA256 bbe2740d66ca1f7a92fc08ce3072ab277d4a8dbe17d5fb0c8f4e1b79a13d9ac8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/1464-262-0x0000000000400000-0x00000000005BC000-memory.dmp
                Download

                memory/5800-261-0x0000000000400000-0x00000000005BC000-memory.dmp
                Download