253487e01aa2482ccbbd70f64bb7dbdb3c82de166e296da2f94f83d493473e7e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Size 1.5MB
Sample260723-sg99cseq3v
SHA256 253487e01aa2482ccbbd70f64bb7dbdb3c82de166e296da2f94f83d493473e7e
MD5 afdf313eae171daf25f277da45cf3cec
SHA1 b26cc42402f1c9d4fd6113eac2635077ed506e11
SHA512 7d8c8d0cf3e3f92e35ff19cb4cb234b47332aba23628e24c4ab525d32492bd554de9c09551b73d873ad4f56dc017ca6f1dc695a8e98b6d61f26151af812a66e5
SSDEEP 24576:3KP2pH7efRtJ3YeEAYOnwj1+M57Ef85PNMLasvqia:3KKe1YeEAYOW1+M5A83M+svqia
TLSH
T19575081177E95A29F1FB2B71AEB851604A7B7C615F31C7CF13802A5E2970AC09936B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5672	2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 2472	5672	2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_afdf313eae171daf25f277da45cf3cec_amadey_avoslocker_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ArmManifest3.msi

Path C:\Users\Admin\AppData\Local\Adobe\ARM\S\ArmManifest3.msi
Size 16KB
SHA256 4a96463a1112ebe2c25293aacb1a4c4550d67cb827fd9333b8ed4d99ea60a0b3
MD5 7430f10f2faa83127e0596b6dfe7028d
SHA1 9b7e7924dc4faa1dd03d998d115cdaf0168d4938
SHA512 12f2b51c767e77c18c21e7e484d5b2cdd6250c1391aa9ce75f13b970cea5946aeeb33c670dc336aeb8e5f534f518918d6922050a965c72daa94f1190328514fb
SSDEEP 192:HgN74WWsVPVpi7L1oIYiYF8XoVs3QwSbLULc8pq8RuwdmL4pUQrNyKQnC:C7LDi+IYi5ugy8RbmL4nNyKC
TLSH
T120724BE3A9909C05DC179D30B8D4962AAA32FC851ED0C2D77159F36E8B713813FD92E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6003.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6003.tmp
Size 5KB
SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
MD5 42ff6aa7e64b25f09ffb2a89ce7f36ba
SHA1 0dbf44a94dbd6801b3afba7a6c602f39c7d44732
SHA512 47337d9919bc26dedfea1af060dd1fa2ef4a3dcf35c0a84ac7bfe0333b4885a368fc46fec5bc317fe257abdbcab9cdff67104382b60e9a1aa5f755aba604adde
SSDEEP 96:6jX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yKSeTEnXtGbE:0ULc8pq8RuwdmL4pUQrNyKQnCE
TLSH
T102C13CA388946C05AC27FC00B4C89933EDB676A61EC1D0D3625CC1A58B913873EDE5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp6FB2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp6FB2.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9B88.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9B88.tmp
Size 5KB
SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
MD5 5a68f4aec3689d0dc750adcae8e60520
SHA1 ebd8482e30140da9e44bebde6e4da997a7391e22
SHA512 311cfca7e98c8db69d2d599c5845d26a4686d03d1ab1d79237952c008269928ce8434a877e3fe411e967995536e2171844df0db14add053037de278571269a04
SSDEEP 96:zX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4ycOr0BO:zULc8pq8RuwdmL4pUQrNycOrkO
TLSH
T127C12AA38DD06C05AC5BFD11B4D89A33ADB276952D81C1C3325CC2658F913973AEE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC4BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC4BC.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 530B
SHA256 79b5fac76168a1776ed73c27e9ab11970a633813d695a1c1e631c4a1ab694ab4
MD5 2cf00a0dc64703862eb272bb42799d47
SHA1 e9aa82546f08d857a2c894e8bfe91aee689105c0
SHA512 40aa0f39d13448f7d72f9a4639dcf9bd3a9d51c84be16b3b02270e31432a295647666278c77ed871b2592792f72078ed74f1d69ba94b32a4da771280661d4be3
TLSH
T161F05E1726F54618F0F75F15DBF990B31B363C025D1884AC9088030E08E1A11D972BB7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 652B
SHA256 eb15f2e99e2b0151b49edf85051c9220937772b652f11c4a461c99813ec34a06
MD5 daee59fb278af9e878252a76ffb89c20
SHA1 64f2e37a6a9221ce65c79850e43c59bd6afe87a5
SHA512 18af70cebeeaf6be704e8e8a7ada0084806d5a9a973b81f0619c3d23d2a6e29b0bccddfdb61cecd3ceddae2a1544aee72ec7a438d454d70a9e89d64153a973c2
TLSH
T10FF0495A22F54618F0F75F15EFF9D0B31B367C026E1994AC90C8031E08E1A61E972BB7
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\Windows\Temp\ArmReport.ini
Size 782B
SHA256 d72b3736aa9cbe9463cdd2095c68f7b681b781b39fc71b447424a643ec31bd76
MD5 00c8ba6dfbb5884dae89b25b37060eb5
SHA1 eb5553ec204d0697ac93a20526aacab3868bd233
SHA512 6977e17cab20b4d61efb0a657a8e6efb6b5ca205079e6375b12867a95ab4a93df5ba9845de5e548ad9ce1d5731d4efaa34fcb112001b1ee8c2ee7e3640d12f12
TLSH
T1A5017C9A1AE91635F0F34F49DFBA94721A327C131E18C99C50C9520E49F1EA1E872B7B
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Windows\Temp\ArmUI.ini
Size 234KB
SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
MD5 cd12a965da4fb66e7f8a07e3f421196c
SHA1 f6377f231362acbd1063aff829ced283a2660b89
SHA512 3fa242c3f573c706e0f36b477ce03f47d9ba0712ef72b94eae4f426dfe21ebbaf1dbebb0981335970b5186d416b4d25e175773796486f39e17de1df0a68a9b0d
SSDEEP 3072:03IJ8zcVOWmxltum8PMkufNWwhEIrKNCpNugYWKOlCIr0YxbFKRWSp4Vf37FbAjO:BxJvW
TLSH
T124342A5667FD1209F6F37F41EEB852944B7B7DA2BE3AC14D1680014E08B5A90DA72B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads