Overview

overview

10

Static

static

10

2026-08-04...ys.exe

windows10-2004-x64

10

2026-08-04...ys.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 17:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
  • Size 1.8MB
  • Sample260804-v8ww6awemf
  • SHA256 f14359668d7b378fdb49cdd8b258fb9b7046f010dcd00f976177b582ad5f90ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryshodispywarestealertrojanworm

Malware Config

Signatures

  • Family: Shodi

    Shodi is a Windows worm written in C++.

    wormshodi
  • Detects Shodi worm 3 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:788
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        3⤵
          PID:2184
        • C:\ProgramData\Adobe\ARM\S\32476\AdobeARMHelper.exe
          "C:\ProgramData\Adobe\ARM\S\32476\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\32476" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3400
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\32476" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5288
            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa
              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa"
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5308
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:6848

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            AcroRd32.exe
            • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
            • Size 2.7MB
            • SHA256 569eda8d67e00572f44f68615cb50ec12484effbab563b9aa1f29ef67bcc964f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AdobeARM.exe
            • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            • Size 1.5MB
            • SHA256 ef534918eac53edae129b3e99f23c3d832685b973ed11de3c94cc6a4984e53da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AdobeARM.usa
            • Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa
            • Size 1.1MB
            • SHA256 03b39c1e40731161ff527db03926e07485c051bb4c0694ab4bf16fcc212cc124
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArmReport.ini
            • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
            • Size 82B
            • SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmReport.ini
            • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
            • Size 782B
            • SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            AdobeARMHelper.exe
            • Path C:\ProgramData\Adobe\ARM\S\32476\AdobeARMHelper.exe
            • Size 413KB
            • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RdrManifest2.msi
            • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
            • Size 18KB
            • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            616AD1AB067CFD351D6C0EF6F3E12F40
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
            • Size 1KB
            • SHA256 0f847033aaf27849f7a161936a76969ca174ec563b2793384cf32b9ea95e6552
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            • Size 471B
            • SHA256 e1b1d51c76d57f616c8ee986e25c6511d4bea28afc50662331bf9b254b6ae3b0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
            • Size 727B
            • SHA256 584564c6ebb0d10fc33f61e622dfbb23f8393c3ff1e48ab9cabc6efe68b78650
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
            • Size 727B
            • SHA256 491d34f8e6ef0eb083e957e263eb07f7a504eee12798914fbf265354dbae7498
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 727B
            • SHA256 895f3912ab7d818c60f98dfe7195fdcc1d1544a4eec908350eac31e7bf0fbcdc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
            • Size 471B
            • SHA256 b9f342aafbf63ca414ce712bd4c851a1f6feb47324e19958864fe3964f2cc59c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            616AD1AB067CFD351D6C0EF6F3E12F40
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
            • Size 252B
            • SHA256 6f3915a027a8a10e4c21bb018938495c4a8c1d54ebb1e5229fdd5584003c00fe
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D
            • Size 396B
            • SHA256 c39712baead0b69c3aee3f4bcc3ceeed752d9cd8505c90e5255f6f8620522d56
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
            • Size 404B
            • SHA256 597878ad8cd7b5a57d0bbe19ef8643c88340f02c80b57f2f1c6b242cfa00ee1b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
            • Size 404B
            • SHA256 adf217730b6146ac19a41674a1296ebd64da5f5d967c640b2fde3c2b3e450901
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
            • Size 412B
            • SHA256 ee408b6054d5df154d8ef6e8457e7d686c572f52da727af647ff4b6b50613170
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC
            • Size 408B
            • SHA256 0728e96309c3d42579ae25b3e836d027c8974855dd5f1e21f0488207e90c7b9e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa
            • Path C:\Users\Admin\AppData\Local\Temp\2026-08-04_e998be5bf9bb55cd81e3bfdb1002aa02_amadey_darkgate_elex_hijackloader_icedid_luca-stealer_njrat_rhadamanthys.usa
            • Size 1.5MB
            • SHA256 434538507c6299325a76974e90d6d876a913c39e27e815d9482bdd1e76e4679b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AdobeARM.log
            • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
            • Size 328B
            • SHA256 7a3360e21226ec9714f2a46cd33f5656e856f89f47d612366178e5eb5d3ec09d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmUI.ini
            • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
            • Size 251KB
            • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Rdr3232479.txt
            • Path C:\Users\Admin\AppData\Local\Temp\Rdr3232479.txt
            • Size 13B
            • SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
            • MD5 SHA1 SHA512
            Submit Download

            ReportUpdaterPolicy32476.txt
            • Path C:\Users\Admin\AppData\Local\Temp\ReportUpdaterPolicy32476.txt
            • Size 4B
            • SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
            • MD5 SHA1 SHA512
            Submit Download

            Tmp3181.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp3181.tmp
            • Size 5KB
            • SHA256 aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Tmp4CEB.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp4CEB.tmp
            • Size 5KB
            • SHA256 27ead591d4c7f8fadd0d9e5d32eb6c9bf8830f83fddf83ddd47e6b3b413f5b75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Tmp4DC6.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp4DC6.tmp
            • Size 3KB
            • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Tmp5624.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp5624.tmp
            • Size 5KB
            • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Tmp8FF3.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\Tmp8FF3.tmp
            • Size 5KB
            • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TmpAAB8.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\TmpAAB8.tmp
            • Size 3KB
            • SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            UsaShohdi.asu
            • Path C:\Windows\SysWOW64\UsaShohdi.asu
            • Size 1.8MB
            • SHA256 35199b8d5589001d1111fda3a5d4cb0c89b3098f139367a45c7afb9cddb3a623
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ArmReport.ini
            • Path C:\Windows\Temp\ArmReport.ini
            • Size 724B
            • SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmReport.ini
            • Path C:\Windows\Temp\ArmReport.ini
            • Size 472B
            • SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmReport.ini
            • Path C:\Windows\Temp\ArmReport.ini
            • Size 594B
            • SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ArmUI.ini
            • Path C:\Windows\Temp\ArmUI.ini
            • Size 234KB
            • SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download