Overview

overview

7

Static

static

3

2026-07-31...er.exe

windows10-2004-x64

7

2026-07-31...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
  • Size 1.6MB
  • Sample260731-tk427adb35
  • SHA256 226a815d546ccc287f8ad9ecd18de3d32348834e1bcf52f68112b5bcef504a06
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 54 IoCs
  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-07-31_f5b861a2f58f3d72b45dbdfbf3ae3947_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
        3⤵
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4536
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 484
          4⤵
          • Program crash
          PID:1356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 420
          4⤵
          • Program crash
          PID:3020
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 496
        3⤵
        • Program crash
        PID:5988
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 508
        3⤵
        • Program crash
        PID:2396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 492
      2⤵
      • Program crash
      PID:1248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 560
      2⤵
      • Program crash
      PID:1672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3480 -ip 3480
    1⤵
      PID:4932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3480 -ip 3480
      1⤵
        PID:3008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1056 -ip 1056
        1⤵
          PID:1128
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1056 -ip 1056
          1⤵
            PID:5024
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4536 -ip 4536
            1⤵
              PID:4584
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4536 -ip 4536
              1⤵
                PID:1568

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    RCXB150.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXB150.tmp
                    • Size 1.7MB
                    • SHA256 fcdcd132d8ba168349973fe48c5f9218a91cc6ba5bb43b7c64b788339cc8796b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RCXB153.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXB153.tmp
                    • Size 1.7MB
                    • SHA256 7b22862c7014dedc19853008f0d81b5c90abf7a397005c9319786ac5e21c6eb8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RCXD1A5.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXD1A5.tmp
                    • Size 4.3MB
                    • SHA256 37b18ed2149ed83929b2da69943c46ab5806e84dbb601224ddd7bcc0363ef998
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RCXD1A6.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXD1A6.tmp
                    • Size 4.4MB
                    • SHA256 26bc957281d3caaa4d9febd7fd41f384e8d99f346f86dfc2bc838f37b85f8b5d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    RCXDADC.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RCXDADC.tmp
                    • Size 457KB
                    • SHA256 a7e8801497148d4723adb9bfeef0a21e0761195241f3da1115a79f746adbadb4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc7F77.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc7F77.tmp
                    • Size 733KB
                    • SHA256 5c80d1ca591b16816a8d926bcb2f49a9ab09b65d7703d7cdbb015557f083ef94
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc7F99.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc7F99.tmp
                    • Size 1.1MB
                    • SHA256 2afdaeb5dd4e02e99c3a99ba844eb116c4a942013106a7e1ef982447c44033fa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc7FAC.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc7FAC.tmp
                    • Size 876KB
                    • SHA256 980f79996bff001760657c06a7af5ea6abb8e8f3aa6e59a5adc49d59f86c8930
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc7FBE.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc7FBE.tmp
                    • Size 199KB
                    • SHA256 d4c75692d12c8d3dffd0aab63bf29896bdf443b9f0114c4c49ca1f92a7c73bf4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc83E8.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc83E8.tmp
                    • Size 2.3MB
                    • SHA256 8c26436e77acabe621ee73296d092bf7c7a115f9e4494bf11f07552699e535db
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc840A.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc840A.tmp
                    • Size 466KB
                    • SHA256 7c2b8046b216eedf32c73de1e3a07d73910f0aca7dcb387cc158f9856d3d0e7a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc841D.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc841D.tmp
                    • Size 232KB
                    • SHA256 4bfe6a6da4fbfc183a46caa97f009ad49a94ed5165b125580311dec4d20ece2e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc8D5A.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc8D5A.tmp
                    • Size 544KB
                    • SHA256 5434297129e2963d1dbce3a5327116c8f43dc0feda90372b80a5ead0554e3a83
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc8E48.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc8E48.tmp
                    • Size 23.7MB
                    • SHA256 16fbfb41adadabf3a348daf409a5dc9c3dc7aff4750bcad1e2bd073deeb97185
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc960B.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc960B.tmp
                    • Size 1.6MB
                    • SHA256 5d3ed1c6f2017ae082a63bf56f10afe1d2641cff0abb956610ea55449da1a60b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUc9B54.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUc9B54.tmp
                    • Size 764KB
                    • SHA256 2160ffb535836d0dc19813dcc890f48d437832db973e380caa30509688b90959
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA123.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA123.tmp
                    • Size 442KB
                    • SHA256 fd07e4b9533c8fac18c7a63e9655f0401560eae02e3812b927265a64c8c3a765
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcA155.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcA155.tmp
                    • Size 281KB
                    • SHA256 c872981f71b07fd244ae3dd6bc330decde00568d8bda8a297e872a18755a9e60
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcB6B4.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcB6B4.tmp
                    • Size 328KB
                    • SHA256 167c10adfce6fb0b8ed1681f2aa4326cbb7127b831df13aeb51bd1bf978a65b9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcC646.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcC646.tmp
                    • Size 423KB
                    • SHA256 036635e69322798218dd6ad3db61619e6930b04f5a20e540fbaec354c2308b3f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcD42A.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcD42A.tmp
                    • Size 3.5MB
                    • SHA256 1bf202a16e0b2ed016cfc719442f82e49b1b20116ba8dae4edc19aca2fa98b10
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcD45C.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcD45C.tmp
                    • Size 219KB
                    • SHA256 367a04a1b71761e78ef85f1ce3a77bd8e80a569b9ee424ff4453fca7f0a9bf17
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcD46F.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcD46F.tmp
                    • Size 852KB
                    • SHA256 7b768b525dbc84c63ee75f4a21a6a51099c81c5e63b443ade810d3515eff1cc3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDB0C.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDB0C.tmp
                    • Size 369KB
                    • SHA256 c543eb3010e89a82d078b14dc64d89c241be22694db1d0b4b59f5c4cd0eef158
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDE5B.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDE5B.tmp
                    • Size 750KB
                    • SHA256 097461794c3ba584f844800ea1d4ba98cbe842dbbfbad1414047da987d51c033
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDE6E.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDE6E.tmp
                    • Size 268KB
                    • SHA256 00aa005411c6be1c1857623165ccade721a43f849c90e41646facdff8000c45a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDE80.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDE80.tmp
                    • Size 325KB
                    • SHA256 7cba13ffe2fe0349c6d6eecb429b296682b16add9a4d084a41200d67672dba7b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDE83.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDE83.tmp
                    • Size 249KB
                    • SHA256 87b5cd0d866056d690e7d84443b72f55544f825cb2bf418f3d5b7f71468d15bf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcDE96.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcDE96.tmp
                    • Size 640KB
                    • SHA256 8532e3efe8461782217a57d7ab4a1825ce09ce3211e34950379ca573d23ecb94
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEDBC.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEDBC.tmp
                    • Size 1.5MB
                    • SHA256 ff843162cb325e1a216dadf7f449664d425c4d82f8700c6df04b7abe988fa1a3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEDCE.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEDCE.tmp
                    • Size 422KB
                    • SHA256 b88eeb9308e1273634e716a1c8c26f8995eaa2c82897098b1622fd4d3841d358
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcEDD1.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcEDD1.tmp
                    • Size 325KB
                    • SHA256 7b7ba10a772ea6bb6739e4018ca8f5f0f123a5911faeb95979cf359b458ae1a2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pUcFA77.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\pUcFA77.tmp
                    • Size 1.1MB
                    • SHA256 b93747312b8e1170484d9c2e0c51d2caa1e859e7faf2f16c43f847779e671ec2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1056-166-0x0000000000400000-0x00000000005AE000-memory.dmp
                    Download

                    memory/3480-109-0x0000000000400000-0x00000000005AE000-memory.dmp
                    Download

                    memory/3480-128-0x0000000000400000-0x00000000005AE000-memory.dmp
                    Download

                    memory/4536-266-0x0000000000400000-0x00000000005AE000-memory.dmp
                    Download

                    memory/4536-349-0x0000000000400000-0x00000000005AE000-memory.dmp
                    Download