Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 22:44
General
- Target 2026-07-23_661f52324d1d6e2e5789c5b5f35147db_amadey_darkgate_elex_glassworm_njrat.exe
- Size 56.8MB
- Sample260723-2n5rwsde39
- SHA256 f79c6c87ac252f96186bb9e4f35ecbd1fabfbe2cd36e8a8ded597aa520ec90dc
Malware Config
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1386405671171391619/CTwOZY2F3cPBJcfRlxgfgokCRJTHRYC2ReBXSr-HXYRQsqIqYAzvZypfPxCmTuLeRiNU
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 4 IoCs
- Detects executables attemping to enumerate video devices using WMI 2 IoCs
- Detects executables containing possible sandbox analysis VM names 2 IoCs
- Detects executables containing possible sandbox analysis VM usernames 2 IoCs
- Detects executables containing possible sandbox system UUIDs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_661f52324d1d6e2e5789c5b5f35147db_amadey_darkgate_elex_glassworm_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_661f52324d1d6e2e5789c5b5f35147db_amadey_darkgate_elex_glassworm_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp51EF.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp51EF.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\tmp51EF.tmp.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zgrqqxck.f3g.ps1
tmp51EF.tmp.exe
memory/1952-20-0x00000000069B0000-0x00000000069D8000-memory.dmp
memory/1952-25-0x00000000069E0000-0x00000000069F2000-memory.dmp
memory/1952-19-0x0000000006900000-0x000000000691D000-memory.dmp
memory/1952-28-0x00000000069E0000-0x00000000069F2000-memory.dmp
memory/1952-35-0x00000000069A0000-0x00000000069AC000-memory.dmp
memory/1952-32-0x00000000069A0000-0x00000000069AC000-memory.dmp
memory/1952-23-0x00000000069B0000-0x00000000069D8000-memory.dmp
memory/1952-3-0x00000000070F0000-0x0000000007A7A000-memory.dmp
memory/1952-16-0x0000000006900000-0x000000000691D000-memory.dmp
memory/1952-11-0x00000000068E0000-0x00000000068F1000-memory.dmp
memory/1952-8-0x00000000068E0000-0x00000000068F1000-memory.dmp
memory/1952-4-0x0000000006930000-0x0000000006970000-memory.dmp
memory/1952-7-0x0000000006930000-0x0000000006970000-memory.dmp
memory/1952-1-0x00000000070F0000-0x0000000007A7A000-memory.dmp
memory/1952-15-0x0000000006B00000-0x0000000006BA8000-memory.dmp
memory/1952-12-0x0000000006B00000-0x0000000006BA8000-memory.dmp
memory/4496-38-0x000002070DA30000-0x000002070DA70000-memory.dmp
memory/4496-68-0x000002070F770000-0x000002070F78E000-memory.dmp
memory/4496-46-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-85-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-67-0x000002070F7B0000-0x000002070F800000-memory.dmp
memory/4496-84-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-82-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-78-0x000002070F810000-0x000002070F81A000-memory.dmp
memory/4496-40-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-39-0x00007FFB5540F000-0x00007FFB55410000-memory.dmp
memory/4496-41-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-66-0x00000207282A0000-0x0000020728316000-memory.dmp
memory/4496-45-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-79-0x0000020728320000-0x0000020728332000-memory.dmp
memory/4496-52-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4496-64-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-60-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-57-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-56-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-58-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-55-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-54-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-53-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-44-0x0000021CC3E50000-0x0000021CC3E72000-memory.dmp
memory/4768-51-0x0000021CDC500000-0x0000021CDC50A000-memory.dmp
memory/4768-83-0x00007FFB55280000-0x00007FFB55C24000-memory.dmp
memory/4768-49-0x0000021CDC210000-0x0000021CDC22E000-memory.dmp
memory/4768-50-0x0000021CDC440000-0x0000021CDC4F2000-memory.dmp