Analysis
- max time kernel
149s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 19:01
General
- Target 2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar.exe
- Size 27.6MB
- Sample260806-xpgn8sssc1
- SHA256 22673cc8c77c8900517c122d7de6a960cb44fce18c9cd90d7407b2b465c4222f
Malware Config
Signatures
- Detects executables containing possible sandbox analysis VM usernames 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fafecc865ac4c64f1e64f878da9c7825_amadey_darkgate_elex_icedid_quasar-rat_stealc_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
studies.db
SQLite.Interop.dll
memory/5888-70-0x0000020D4AB60000-0x0000020D4AB87000-memory.dmp
memory/5888-86-0x0000020D4DBC0000-0x0000020D4DBC8000-memory.dmp
memory/5888-4-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-5-0x0000020D2D470000-0x0000020D2D4C0000-memory.dmp
memory/5888-6-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-7-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-8-0x0000020D47430000-0x0000020D47554000-memory.dmp
memory/5888-10-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-9-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-28-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-31-0x0000020D47590000-0x0000020D475CA000-memory.dmp
memory/5888-33-0x0000020D48520000-0x0000020D4855E000-memory.dmp
memory/5888-32-0x0000020D483B0000-0x0000020D48524000-memory.dmp
memory/5888-30-0x0000020D48100000-0x0000020D4835E000-memory.dmp
memory/5888-54-0x0000020D48890000-0x0000020D488FC000-memory.dmp
memory/5888-55-0x0000020D48930000-0x0000020D49686000-memory.dmp
memory/5888-56-0x0000020D48900000-0x0000020D48934000-memory.dmp
memory/5888-57-0x0000020D49A50000-0x0000020D49B0A000-memory.dmp
memory/5888-58-0x0000020D49990000-0x0000020D499AC000-memory.dmp
memory/5888-59-0x0000020D499F0000-0x0000020D49A30000-memory.dmp
memory/5888-60-0x0000020D49B10000-0x0000020D49B5C000-memory.dmp
memory/5888-61-0x0000020D49B60000-0x0000020D49D76000-memory.dmp
memory/5888-62-0x0000020D499B0000-0x0000020D499EA000-memory.dmp
memory/5888-63-0x0000020D49D70000-0x0000020D49DCC000-memory.dmp
memory/5888-64-0x0000020D49DD0000-0x0000020D49E0E000-memory.dmp
memory/5888-2-0x0000020D2B2F0000-0x0000020D2CE88000-memory.dmp
memory/5888-68-0x0000020D49E50000-0x0000020D49F54000-memory.dmp
memory/5888-0-0x00007FF86229F000-0x00007FF8622A0000-memory.dmp
memory/5888-69-0x0000020D4ABA0000-0x0000020D4ABDA000-memory.dmp
memory/5888-83-0x0000020D4B880000-0x0000020D4B890000-memory.dmp
memory/5888-3-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-78-0x0000020D49A30000-0x0000020D49A4E000-memory.dmp
memory/5888-1-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-84-0x0000020D4B890000-0x0000020D4BB46000-memory.dmp
memory/5888-85-0x0000020D4BB70000-0x0000020D4BB78000-memory.dmp
memory/5888-82-0x0000020D4AE80000-0x0000020D4B076000-memory.dmp
memory/5888-87-0x0000020D4DBF0000-0x0000020D4DBF8000-memory.dmp
memory/5888-88-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-89-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-93-0x0000020D4E950000-0x0000020D4E95E000-memory.dmp
memory/5888-94-0x0000020D4E970000-0x0000020D4E978000-memory.dmp
memory/5888-92-0x0000020D4EA10000-0x0000020D4EA4E000-memory.dmp
memory/5888-95-0x0000020D4EA50000-0x0000020D4EA9A000-memory.dmp
memory/5888-103-0x0000020D53330000-0x0000020D53350000-memory.dmp
memory/5888-102-0x0000020D531D0000-0x0000020D531F8000-memory.dmp
memory/5888-101-0x0000020D530D0000-0x0000020D531D0000-memory.dmp
memory/5888-110-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-119-0x0000020D530C0000-0x0000020D530C8000-memory.dmp
memory/5888-118-0x0000020D53270000-0x0000020D53286000-memory.dmp
memory/5888-117-0x0000020D52C00000-0x0000020D52C0A000-memory.dmp
memory/5888-116-0x0000020D53240000-0x0000020D53266000-memory.dmp
memory/5888-115-0x0000020D52CB0000-0x0000020D52CBA000-memory.dmp
memory/5888-114-0x0000020D52C10000-0x0000020D52CB0000-memory.dmp
memory/5888-120-0x0000020D53310000-0x0000020D5331A000-memory.dmp
memory/5888-121-0x0000020D53360000-0x0000020D5337E000-memory.dmp
memory/5888-122-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-123-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-125-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-126-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-127-0x00007FF862110000-0x00007FF862AB4000-memory.dmp
memory/5888-128-0x00007FF862110000-0x00007FF862AB4000-memory.dmp