f8f3d33840680bc45c2f6f855565be37c3b78918374e7d98b2b41953229fec60

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_39fcb8d35b99e61f92bdc835d284f892_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 2.8MB
Sample260802-bb3hws1sdy
SHA256 f8f3d33840680bc45c2f6f855565be37c3b78918374e7d98b2b41953229fec60
MD5 39fcb8d35b99e61f92bdc835d284f892
SHA1 d571577b38bbe1f359caaa5cffcc419853cf069b
SHA512 e9e8b39eb0735728f4189a476881090b310583296ae2c5639ff538177f4a7597fadcc07d0c697a1857bf3a0a7a913e7eee472bbfec201fd63dafb4ea88100deb
SSDEEP 49152:4Zv1BDtBFlNkpwvGnDVc8PQzbIN4WpH7tWDJS/Nu:yDD7rNkpwvGnDVc8PQzbIN4WpHsDR
TLSH
T17DD58E317545482BC15342716D9DF339A1BD71B81B3166E7B3C89EB82E22CC3652AF2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_39fcb8d35b99e61f92bdc835d284f892_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3004	2026-08-01_39fcb8d35b99e61f92bdc835d284f892_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_39fcb8d35b99e61f92bdc835d284f892_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_39fcb8d35b99e61f92bdc835d284f892_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads