Overview

overview

7

Static

static

3

2026-08-10...er.exe

windows10-2004-x64

7

2026-08-10...er.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 05:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_e760558543d351bb4ee147438c5d0348_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
  • Size 1.7MB
  • Sample260810-gfvxhasbmf
  • SHA256 7ac1ba0aac790f305d6d871663defd190ecd34ef8afdd0caa429e282d8ee75ed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Program Files directory 13 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_e760558543d351bb4ee147438c5d0348_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_e760558543d351bb4ee147438c5d0348_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:5956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 524
      2⤵
      • Program crash
      PID:808
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5956 -s 524
      2⤵
      • Program crash
      PID:1876
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5956 -ip 5956
    1⤵
      PID:2272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5956 -ip 5956
      1⤵
        PID:4308

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            pUc100D.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc100D.tmp
            • Size 1.7MB
            • SHA256 509a329159f435ff5bd4eaa014a131d2dcc4911bf9d727ad3144e01fd4b1c890
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUc15E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUc15E.tmp
            • Size 4.3MB
            • SHA256 14a15a846ab9747441b659bb2deb59d2a1a5f1868a40657b4d5ba2a3bca9831a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcE0E0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcE0E0.tmp
            • Size 754KB
            • SHA256 ae53e9750fe79dd40fdf58c444a26958e77b06fd956df1d17bb962e51c5c2b13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcE45E.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcE45E.tmp
            • Size 1.1MB
            • SHA256 a208273c6dc53e3a2096abacb06bb6a14e50e30c4be0cc20d125e807025ced6a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcE4CE.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcE4CE.tmp
            • Size 897KB
            • SHA256 440d447b275062ccbdfdcd84a8a8ad4075a2d9ebce99b8491e14f81714ff82af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcE90.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcE90.tmp
            • Size 564KB
            • SHA256 c8d4f8884bc2c5d99c5e576bd85abedd4ca734214e9abacdfbb2caa8d8d1cb06
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcEF1.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcEF1.tmp
            • Size 23.7MB
            • SHA256 97a087f3307d51c901238826eea0f60e796736c6e51fa31ec4cace4f8347a1c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcF1D2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcF1D2.tmp
            • Size 219KB
            • SHA256 835ea5888cd9f8f3bfc950a12f8ab6541f9e7a7cfe76d442a30e484a692bf7a4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcF1E4.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcF1E4.tmp
            • Size 2.3MB
            • SHA256 86c69f8f3f164422da6e39b43acf7e4c216d57cb90decd5ae985e00f01eeb8b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcF1F7.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcF1F7.tmp
            • Size 486KB
            • SHA256 bef18d30aef357a8600dac615028e19a125ba5d83e4b08ddd0cb5af288746951
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pUcF209.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\pUcF209.tmp
            • Size 252KB
            • SHA256 d16dbbb237464e6bca7128181988532cd23d8b95dcb614a34e97c6cd07fa25a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5956-64-0x0000000000400000-0x00000000005B3000-memory.dmp
            Download

            memory/5956-90-0x0000000000400000-0x00000000005B3000-memory.dmp
            Download