19a20920378362661d3647061a429ce8ad01ea287f5395f3a8c043c8cd2b00d5

General

Target
2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 5.5MB
Sample260804-gvkebasemf
SHA256 19a20920378362661d3647061a429ce8ad01ea287f5395f3a8c043c8cd2b00d5
MD5 9d0c9f6c69ba37ece74433f49ac1eebc
SHA1 1cabcdf1ba62b755b9624404581a1880673aa761
SHA512 e86bbde48e8498fffc54e3217bb066fce317f40204c162a46d809868b5d6fdba4f4d48db4934d41925d5c5f6628a8fdd0ed15f0fb7fc1ac746de5e55a77089be
SSDEEP 49152:mtqiKYHrJg1NNNRNNNTONZ/TO98VChBtzysUVap/UkKYHrJg1NNNRNNNTONZ/TOk:JqybtzysiQybtzysi
TLSH
T10246BE00EFA16836FC3645364DAA23764438ED31F74205DFA293FA1E57649F2293729B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/4240-12-0x0000000010000000-0x00000000100FC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Downloads MZ/PE file 2 IoCs

flow	pid	Process
4	5644	2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
4	5644	2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe

Executes dropped EXE 3 IoCs

pid	Process
4240	BDSubWiz.exe
5840	udblzdqubu.exe
4312	z5644.exe

Loads dropped DLL 2 IoCs

pid	Process
4240	BDSubWiz.exe
5840	udblzdqubu.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDSubWiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	udblzdqubu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z5644.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6064	cmd.exe
5052	PING.EXE
4404	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5052	PING.EXE
4404	PING.EXE

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
4240	BDSubWiz.exe
4240	BDSubWiz.exe
5840	udblzdqubu.exe
5840	udblzdqubu.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
2004	svchost.exe
1948	dllhost.exe
1948	dllhost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 4240	5644	2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe	89
PID 5840 wrote to memory of 2004	5840	udblzdqubu.exe	92
PID 5840 wrote to memory of 2004	5840	udblzdqubu.exe	92
PID 2004 wrote to memory of 1948	2004	svchost.exe	93
PID 2004 wrote to memory of 1948	2004	svchost.exe	93
PID 5644 wrote to memory of 6064	5644	2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe	94
PID 6064 wrote to memory of 5052	6064	cmd.exe	96
PID 6064 wrote to memory of 4404	6064	cmd.exe	97
PID 6064 wrote to memory of 4312	6064	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
  "C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-04_9d0c9f6c69ba37ece74433f49ac1eebc_amadey_darkgate_elex_" && cd /d "C:\Users\Admin\Downloads\" && ping 127.0.0.1 -n 2 >nul && "C:\Users\Admin\Downloads\z5644.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5052
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4404
- - C:\Users\Admin\Downloads\z5644.exe
    "C:\Users\Admin\Downloads\z5644.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4312

C:\Users\Default\AppData\Local\Microsoft\Office\39.0\udblzdqu\udblzdqubu.exe
C:\Users\Default\AppData\Local\Microsoft\Office\39.0\udblzdqu\udblzdqubu.exe -svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe -k netsvcs
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe" -ks
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDSubWiz.exe

Path C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
Size 912KB
SHA256 84184943ae6d94b547885764b0f361e9dd9d74a517ad10621b1ef3d0eecf6702
MD5 a1b7601ff2db87b599149b2b00ff64de
SHA1 27f6dd3e46a769f650840cf42ce94e2b66a55abc
SHA512 f02fe55d61a879105ce49f8113c619278b36cd60d3981df685c7e132ee9c4ae782d43139af89624be145bf5de8a68b28420e8b5b8f4aee8b21c5a37993bfccfa
SSDEEP 24576:yE/TOVq28VC9ruYau/7y/kwbiJ4Rap0+C1c:J/TO98VChBtzysUVap/Uc
TLSH
T1D6159F2175C1A037F57301328FBD962D451CB8220B15AADBB3E8172D9B69AF13E3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dat
Size 1.3MB
SHA256 d17fed58809f471b930349677db36da634c4acd015b62eae66114b3271c80b07
MD5 9167cfcc8f35deab645977a5ebbfa6cf
SHA1 02c9a19ffe7cbb1e56057bc72c8a064af221a2a9
SHA512 6af261bd4226092d220fde8a6635535b27c83af74b6e4f78850ed02c679520697d16cc0ccac0835d2c125a5578aa49106ff7ed58e3b3be6b930611827a22d534
SSDEEP 24576:SaH1KrHMVHr3H5P/QDx1NNNRNNNB2EOyy8q5SBuLguALsaZ0:FKYHrJg1NNNRNNNTONX
TLSH
T18D555B81CE626905FE28D5BA0D8227A24474EAB9F6C705DC4513F41FA7B4C3B112B6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dll

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dll
Size 100KB
SHA256 30b479947be489553abadcc44a5af0152b647820ac34c1e7f2436d583c4cbed1
MD5 2eee591d4e02a0dbe7e56578236d15e1
SHA1 0e397deaba901d037e2d0b3b587275e7f1528862
SHA512 0d5acf67b7cd7946c363749ca267c40a02eb9679399256409c8d72c85d0259b280dca108a22427c802b7343a149241a094733f01d3ca11c1bac5a0e9b8a2efd8
SSDEEP 1536:5dk8lz9SEYIEGrhsENOMUGNImpHJi464adW:5dk8rSHmpJ4s
TLSH
T1AFA349456BA0EFB7E5414B3588F34314DE3AD1170B821ADF6C564238AF627E94EB3B06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-10-0x0000000002E40000-0x0000000002F8C000-memory.dmp

Download

memory/4240-12-0x0000000010000000-0x00000000100FC000-memory.dmp

Download

memory/4240-40-0x0000000074E90000-0x0000000074EA7000-memory.dmp

Download

memory/4240-39-0x0000000000510000-0x00000000005F6000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads