5fcee69f9cf26e4709741532ad2b94c1fcd99d0da955d4c9b81ee6490042726b

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
Size 1.2MB
Sample260718-be1tgae16s
SHA256 5fcee69f9cf26e4709741532ad2b94c1fcd99d0da955d4c9b81ee6490042726b
MD5 5d2a2d9815dc09c73b58bca4302dd600
SHA1 cdc05320a354accf734c0c6fc77a09089754f711
SHA512 fff30de0620e7c70a86b96400dd95b5fabb55cd4fea1581717198417aa20744f8b4fbb2f4f05d5c16a8522180eebb1ca0c9b9a405bf0f937fdd68411afc8c6ce
SSDEEP 24576:jLHkBRhKEsSASJ7XfUw+HkX1NrLR8gbxHJubjZoQULiTTK8ydN4:jLEBRhnsMYeSgVpMiITu8ydW
TLSH
T10D457D22B5428432D3910070DDBDE6B55B6CBE6C07FA04FBB3847AED79705C23A35A96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1728-2-0x0000000000400000-0x000000000046D000-memory.dmp	UPX
behavioral2/memory/2112-13-0x0000000000400000-0x000000000046D000-memory.dmp	UPX
behavioral2/memory/1728-17-0x0000000000400000-0x000000000046D000-memory.dmp	UPX
behavioral2/memory/2112-15-0x0000000000400000-0x000000000046D000-memory.dmp	UPX

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\TXPlatform.exe	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
File created	C:\Windows\SysWOW64\drivers\TXPlatform.exe	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe

Executes dropped EXE 1 IoCs

pid	Process
2112	TXPlatform.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TXPlatform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1728	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
1728	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
2112	TXPlatform.exe
2112	TXPlatform.exe
2112	TXPlatform.exe
2112	TXPlatform.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 4304	1728	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe	88
PID 1728 wrote to memory of 2112	1728	2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5d2a2d9815dc09c73b58bca4302dd600_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\86$$.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\SysWOW64\drivers\TXPlatform.exe
  C:\Windows\system32\drivers\TXPlatform.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

86$$.bat

Path C:\Users\Admin\AppData\Local\Temp\86$$.bat
Size 893B
SHA256 cd0e6012052bc38e3e446a4faa2d5899e7fdedb261c40abb3ed3e6057c5b1904
MD5 ffd9cf3f9c6890aedf926b7ca8ff7231
SHA1 d335c82968fbf26c9966263063f1bc92b804eac6
SHA512 450adc71fbc86f068aa30c322df5327c94484786cef975c7a901c23baee1194fd781e0acd87e42336d4858e139021e22e8abfe786733d6ced96559d10853c32e
TLSH
T13F112C5185BEC96005B7E87FB761154DE097A4CF7A292700373DC7AE62D981B74D7B00
MD5 SHA1 SHA512 TLSH

Submit Download

TXPlatform.exe

Path C:\Windows\SysWOW64\Drivers\TXPlatform.exe
Size 74KB
SHA256 9785a5cc8292adc8c6ac995d3cc27a4b859336be2b2a39015636e4a9dc255e71
MD5 d31874c46da710b3079442d11f087e0f
SHA1 7d60a496c5c00eb587f7d80f9a5fbb64551b69f2
SHA512 71895cdaf50f61761555c5dded1d5b0c72f11fb781a1153537ba1dc39c94e3f57322394d80162cfc26bae6b967a8c786afa4a83aaa7613d830b794b13909c82f
SSDEEP 1536:uc20jqvMiUhitG80L1VVcuCOmSfNu4r4r3y0QPcWQ9y0IuQt0qqH:jPvnhK0ZDBvNKCkWCIu/j
TLSH
T13073025F87550D10C4286C703C6A1ADDFC0C9CF09B1D6787621E793A9EF12F4E98A4E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-0-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1728-2-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/1728-1-0x0000000000458000-0x0000000000459000-memory.dmp

Download

memory/1728-17-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2112-13-0x0000000000400000-0x000000000046D000-memory.dmp

Download

memory/2112-15-0x0000000000400000-0x000000000046D000-memory.dmp

Download