db372532d38a87dd2ff4f3c0e3591baa165a3bc09438376d5c1f6307a854c0a4

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
Size 3.6MB
Sample260812-p1s8eavvas
SHA256 db372532d38a87dd2ff4f3c0e3591baa165a3bc09438376d5c1f6307a854c0a4
MD5 e4e91abd8302390d5dffbb83ab6ab618
SHA1 5ab63694496c3a11e4947d97f546c06aa32b423a
SHA512 faef514deffa7158f37f16b2ba64225c93e3db1790e532753a402f702814f22305763ad1dff8068628e952a2dd1dc8acd9a6dd68af9cd1316a568590366d9e29
SSDEEP 98304:os4yoK+e4rsulqpWLgC/JZt0XVV8yb0nDD527BWG:ofeeVbt0XV+JVQBWG
TLSH
T1AB069E22B5D06362EEE30E314568F636E1BD6D203F3559CB12C4BA6919F31C28E3956F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5752	2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
5752	2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_e4e91abd8302390d5dffbb83ab6ab618_amadey_coinminer_darkgate_elex_luca-stealer_lynx_njrat_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5752-0-0x0000000000400000-0x0000000000799000-memory.dmp

Download

memory/5752-1-0x0000000000400000-0x0000000000799000-memory.dmp