Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
12 signatures
150 seconds
General
- Target 2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
- Size 3.4MB
- Sample260819-hd8k9ayend
- SHA256 e722ec565f4877712fe6ec35f68cd1571882e5806ac11930385ec3ac4d7599d0
- MD5 0591ad7cb40ca8a21c62ea2490be815b
- SHA1 f724d5c9575377e76832a7461dc12af7b7c8e864
- SHA512 9b96e1cb79e56b521c98760ce09a426573a81e692e7342d6135de426d03289100b671ead525c6c9bc134847c26695cbb7bad6e5718d8c7d69f2adc18c59dd97c
- SSDEEP 98304:cfGavQssmHHUC0z55tgUJjwk0rcZvE1XnC3YTI:cf1P/UJjf0rm6nC3Yk
- TLSH T1FCF50212764592B6D5A210F2E8FDBB7768BCB5710B2542CBF3D80E6E59700D23A3B247
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: 2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe File opened (read-only) \??\F: Updater.exe File opened (read-only) \??\F: Client.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 3 IoCs
pid Process 2324 Client.exe 3868 Updater.exe 5968 Client.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Updater.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG\Client.exe = "1" Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\Client.exe = "1" Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Client.exe = "1" Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Client.exe = "12001" Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\Client.exe = "1" Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\Client.exe = "1" Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\Client.exe = "1" Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\Client.exe = "1" Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL Client.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_96DPI_PIXEL\Client.exe = "1" Client.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT Client.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2324 Client.exe 2324 Client.exe 2324 Client.exe 2324 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe 5968 Client.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5968 Client.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5968 Client.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 Client.exe 5968 Client.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5536 wrote to memory of 2324 5536 2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe 88 PID 2324 wrote to memory of 3868 2324 Client.exe 89 PID 3868 wrote to memory of 5968 3868 Updater.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
F:\Program Files (x86)\STNetSpeeder\Client.exe"F:\Program Files (x86)\STNetSpeeder\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
F:\Program Files (x86)\STNetSpeeder\Updater.exe"F:\Program Files (x86)\STNetSpeeder\Updater.exe" -path="F:\Program Files (x86)\STNetSpeeder" -silent=y -self=y3⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
F:\Program Files (x86)\STNetSpeeder\Client.exe"F:\Program Files (x86)\STNetSpeeder\Client.exe" -path="F:\Program Files (x86)\STNetSpeeder" -silent=y -self=y4⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5968
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path F:\Program Files (x86)\STNetSpeeder\Client.exe
- Size 3.9MB
- SHA256 d38c5c8d13f5acc01a2fcc09b385bbe81f65494a132ae2503ba7d6a0c270cf19
- MD5 cec45e8e691ea38a41abb0efc01663f3
- SHA1 ef194368734dd3595203c9a8e215a249981ab852
- SHA512 e195b7d202a8b3386353bb50a516bf85ca3ff35c22a7d530c3ad5f548d11209653bb8bc1aa89c98f0c51eb2d0b48accef01cb2d558cdf22bf370f6b1ebeb2cdb
- SSDEEP 49152:Jnjrz+smJXmeoArEMf3b4SbNXtUbshX/krkP6QeE5buRRTFyajh0n/6KWzwnCmFe:lrqsmWeoArEMP1cr47cjyaep7nCL
- TLSH T17116CF22B6029071E9A601F0A97DEBBFD57CB9300B6511CBA3D44E6D4A707D23F36627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\Client.exe
- Size 3.9MB
- SHA256 61b464384e258bc6914e89d220cd59c583ab62120f07258150b3cd6a343baeb8
- MD5 c436264445845ac20f5a088beb310ca2
- SHA1 fac16eae40c731db77324357f7d53ee5076f29fa
- SHA512 620f7307531d16034c09d71cd4219edfd382698b9fc6b96d35d8db58332e6ca614a260841014610b152e5fe6273f58675c1433766867aab93cdff621b501e377
- SSDEEP 98304:iPJ1IKqRlyjWMTbmuASs+GtQoc7cmyaep7nCf8Q:SJMDyaMChQp7aaep7nCf8Q
- TLSH T15516CF22B642D071E9A601F0A97EFBBF957CB9300B6511CBA3D40E6D49706D23B36727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\Log\Client_INFO.20260819-073837.2324.txt
- Size 180B
- SHA256 36f40df6b091f678491f413f85fa1973c11e40e8891af8247ae0c44d48f628a0
- MD5 c54fe94de349512cf8c9516bb98f1bd4
- SHA1 11e72afc012ea6df9f7b4a8d5b2dea8812a3cb4f
- SHA512 77888f987fa278135a947ab260902a47114fec6d2ceeaf3c03ebf6ab909a9853e28e86f443da25776438d3c545e8f4051f40b97be8b8e6edcca1f6328590e56c
- TLSH T13DC0C08450E000F2D9A514E37EE00300C65CF15F8311D033E044054FA271C1220EDDF0
- MD5 SHA1 SHA512 TLSH
- Path F:\Program Files (x86)\STNetSpeeder\Updater.exe
- Size 3.4MB
- SHA256 7ef1949369a136607857d5fa123a0044f100c3c9aab470bb9215f6848504b912
- MD5 b1e5de83ea948095258a3be6a5d36dea
- SHA1 4db69a12210f6847d86c9c2a420d2408dedfda28
- SHA512 389136673f1fbb4631a08f43301b735d27d1262d55b5998386abe066f6ba666943987a4e19ba9ccb3a16c73a07fc231b7438a8ffdce343d028fb41334b5b9de1
- SSDEEP 98304:HFTRpoyqEWghItr8+wEvGu5ZiLT7c98OnCR:HFTAyqEWghs8fJ6Cc98OnCR
- TLSH T109F512123A5582B2D9A210F2E9FDB77758BCB5710B2502CBE3C80E6E69744D13E3B647
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 43B
- SHA256 72aebada9525296dd28a0ab65ae821ce4c367f71b3d8b467608375679264cd54
- MD5 f39b9a0f3bec7519980694154828ca36
- SHA1 da0332e9ec1783d91f0f3a11c053e22634e6a1e0
- SHA512 1c101003c8b3acffe1f4fa800697d333bb1705757543fc620dc151876b1311e2bc6a748d38a51f182f349908ded77336e5e0bbdb98dbcc41366752403242faf7
- MD5 SHA1 SHA512
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 17KB
- SHA256 32680c1527c7c5d76d47ba437b45ebd1a7ae5e19299e4042f7feb195bdf5aa80
- MD5 6c4b74c6e9d9f1bf3602e84472ebdb66
- SHA1 ff54791611aa5af502efeaf7ce591f11ea39d1d8
- SHA512 bb2a108f1860378ae37b55f530f8f259a5824833d68b917b02a1c677331ab16325cd249b81271f98d7b0aa340177ea607012054d3c5df4ff0d1f8aba8466a74a
- SSDEEP 384:od8Blpi1tI6+S2CtkmlM4coFDCarJWfa41GVTCgwE7q1Mfs8uA39jVppURzxGVWm:od8Blpi1OpS2CtkmlM4coFDCGt+GVTC8
- TLSH T17082F8E58E2B76118F78E04629AA72433AC0C793605A8AD7D2D5C77630F6D8D29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 11KB
- SHA256 fb65af9a2c2cf57bee4a47f36d48e53668708011707760b141273f002dfe9175
- MD5 741c8fa8fafaf8b9c978b5be9b0fee79
- SHA1 9b446edce700c7f910c18ad5a1d0b5290b0f1d72
- SHA512 d04d15c579b81dca0a1571b10a49cb2c2f6a8d282770b6366a0c8636e9fc91c679c0e2218549a1ad92c4a2af1aaf4cf77d15a8718f11cf794919892cfd84b5f8
- SSDEEP 192:o6WDpKWGAAaO1tIXqdIH5g2Ctk5lMUcopCJFrNJ9Ufa41GLTCYxWdr4+rJi6cAsU:o6WcZl51tI6+S2Ctk5lMUcopCJrJWfaC
- TLSH T14D32FAE5892B72108F78E04629A676433AC1D393606A8DDBD2D5D77630F6D8C29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 10KB
- SHA256 c3b68697df3882596bd82e7c9018ae4b9768ceb5008723d82e2163d6ade99646
- MD5 7e1954cc0fcf2bc60fc218c4c772c8db
- SHA1 88aa0915bdbb9083bc4601ba576f016fa73bf902
- SHA512 e07b6402032cb7b3366e681bcd461e46d3378e4cd98ef79e5cef27548984f21c86f88a23d9e876e275bd352a0e142ccba5b0fedb58feddde1a3d4c7f8dbfe33b
- SSDEEP 192:o6WDpKWGAAaO1tIXqdIH5g2Ctk5lMUcopCJFrNJ9Ufa41GLTCYxWdr4+rJi6cAsV:o6WcZl51tI6+S2Ctk5lMUcopCJrJWfaL
- TLSH T1A932F9E5892B72108F78E04629A6764339C0D393606A89DBD2D5C7B630F6D8C29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 13KB
- SHA256 c2bdc7725ed64e07f009ae9d452a6b014129c5fe00737a7068845a4710898e5f
- MD5 3e9bf6bc20484eec1c7faad5e1d5203c
- SHA1 4eab6592ebe306d330187d24909cb288c30be463
- SHA512 155a9d13278a7c1c5f3d5ef76e1027c9fd787293c4457236943f5cae90c24bff2ed245fe1725066487299462e73c783ac43740c3e6f4302261c7e7b0244083b5
- SSDEEP 384:ojhDk0h1tI6+S2CtkXlM6copCOrJWfa41GLTCppni1ijsguP39jZppIRzaGVWUgM:ojhDk0h1OpS2CtkXlM6copC6t+GLTCpJ
- TLSH T11F520AE5892B72218F78E04629AA76433AC0D393605A8DDBD2D5D77630F6D8D28D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 15KB
- SHA256 ae91b7f31522e559a41433542d5cf657ec7b81c86e568fcf4e0018a679c9fb65
- MD5 2affe2f73de085c3e854dbfa502fe039
- SHA1 aff24cec4916690955732366750998eb8809b634
- SHA512 4eed4b3dc31dde6276e7c75fb2d82f47352ec771c30a50e1fa5e86df2281c456007db897ca3d14e3a05bfd5dd0c52f9ccb7ce2f0dfdf7b2d1a40bd6333cf4e1c
- SSDEEP 384:ohvH5+B1tI6+S2CtkJlM4coF0CarJWfa41GVTCgwEAO1hvsXuk39jOppURzDGVW8:ohvH5+B1OpS2CtkJlM4coF0CGt+GVTCY
- TLSH T18172F9E5892B76118F78E04629AA72433AC0C393605A8ED7D2D5C7B634F6D8D29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 16KB
- SHA256 3d2a555bbc70c04ec9b1a15e8ecce8166a9facfdd82e1b133971c4299dbf4e26
- MD5 2dcbf4cbbdb07b2339dee65bb26246f4
- SHA1 4f57d5f65365271a1a3558f5ca39a3f4dee549c6
- SHA512 1594d31974e8f515f590706f473d7859c784194eef665a489c52d8744ea22aaa16a3715fa2552ec3e1fb7ad29a949800fbb711f80589f2c991fe2c821183c2b6
- SSDEEP 384:ojvB50W1tI6+S2CtkJlM4coF0CarJWfa41GVTCgwEAO1hvs2uk39jOppURzDGVWj:ojvB50W1OpS2CtkJlM4coF0CGt+GVTC+
- TLSH T12972F9E18A2B76118F78E04629AA72433AC0C393605A8ED7D2D5C77630F6D8D29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 15KB
- SHA256 63b123a31bd448223789ed7cbeb4ec605c434d87306501845179dd0286e1547c
- MD5 6656fbc8a54929122c7ae3173ef18689
- SHA1 209ee953f58a5cb20c703c15d0f22bfb23dd96cb
- SHA512 ca3bb068980a16e5afaa1b5c88ceed408162d610e5fea1ccf135ae205a8896c6c1b62ce0a0cef2b49fb11d8cdda5847e865bf7261f73e12ea27cae595f119b58
- SSDEEP 384:ojvB50W1tI6+S2CtkJlM4coF0CarJWfa41GVTCgwEAO1hvs2uk39jOppURzDGVWS:ojvB50W1OpS2CtkJlM4coF0CGt+GVTCB
- TLSH T12672F9E18A2B76114F78E04629AA76433AC0C393609A8ED7D2D5C77630F6D8D29D733C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
- Size 16KB
- SHA256 5183097ee73886eb28db493ff8ebf033687bc0613eb58c06337b8527eec005c4
- MD5 70766b4cb90e9ed6fcc6c89732acc403
- SHA1 0dc7c4ac00d18f8926eaca6e03502378ad9e298a
- SHA512 bdb27e896c13aac64506c5fd977bbe4e91571fb8c7f457bcfb6fe02b323fa1401cf10dba721194a8f63f40fd1df119d8b0fe7ae6bc72f8886ffc68759f6d0740
- SSDEEP 384:omCB5AW1tI6+S2Ctk8lM4coF0CarJWfa41GVTCgwEHJ15fs8uA39jOppURzxGVWx:omCB5AW1OpS2Ctk8lM4coF0CGt+GVTC4
- TLSH T1C972F9E58A2B76118F78E04629AA72433AC0C393605A8ED7D2D5C77630F6D8D29D773C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\Program Files (x86)\STNetSpeeder\seo.dat
- Size 12B
- SHA256 fc364af26c68714a5ce7f8435a9671933c531675526b69d5a7f1f47b1b45a4a9
- MD5 6bae8cb1e4ae2c70771a370182fbbe57
- SHA1 9509707215c8a0f513ec9f8af8548bee8aa2cca8
- SHA512 bb6f9174b794fa227d3344438553fda12833c35f8cae7c77457da3bba54299800ff6b14ff5a73769c34da362132b2c197de636db46322f93cf4b9fe75000859e
- MD5 SHA1 SHA512
- Path F:\Program Files (x86)\STNetSpeeder\uninst.exe
- Size 350KB
- SHA256 d00a4dd4d00d6ac4c9a01d100bf1b3b4e5fe401d778fe8dbb5040c59acc0da7b
- MD5 c2f7fad7f1c75a6233c6c17c4d145c90
- SHA1 972ebecb2da201df45ae0d46a73461e69880fe0c
- SHA512 14fda2b0d0a23e29ce396276628eed751eebc210e74875d627088721d9fc56e1c54b03cafde242874859d24a06b6bf9ea20c558e5982915511d5af9883952258
- SSDEEP 6144:g6GmEjUl7QQCHmiHUSZRCiiElAOhHY8V77x+7jnCInoaaGS:g6GmEjUnCGiHUSzlzx7x+fnCInoaS
- TLSH T1E0749C127C62C5F6C9F328F848F6527199B8B5620B6646D7A7B50FFCCE3C1D03662862
- MD5 SHA1 SHA512 SSDEEP TLSH