9258a4335c97ce2fa71a865fa3a6c11d4066fb5f3073b0f7efed9e4dbd44021b

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 03:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Size 3.6MB
Sample260730-d6plmayeph
SHA256 9258a4335c97ce2fa71a865fa3a6c11d4066fb5f3073b0f7efed9e4dbd44021b
MD5 4077b29d14d79c80284569e23e268f45
SHA1 faa30cffb5cbbbdb723b919c01f4e2cd91dcdc85
SHA512 74072cb9ea82022e508e739f93d9e4f8757f2b00ba06f461c97f8e54e98dced8569e31dd49b04dfbe8468d2995fc9dafcdc0454c82093776490e1e0037abbc06
SSDEEP 49152:RaapY/J1HB7tIa2ZmHfeLAGyX9RFEVFIbod/EjQMKMZ288J+KVBtvtMtedpxzwCM:tpggaUm/eoXnmVFtd/2KTjZ
TLSH
T1CC067D30BB06887BE5C312B55E7CB76A85299F320B715CC393E47A6D1E611C22733A97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avast Software\Avast	2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4077b29d14d79c80284569e23e268f45_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads