Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 06:38

General

  • Target
    2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
  • Size 3.4MB
  • Sample260819-hd8k9ayend
  • SHA256 e722ec565f4877712fe6ec35f68cd1571882e5806ac11930385ec3ac4d7599d0
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_0591ad7cb40ca8a21c62ea2490be815b_amadey_darkgate_elex_glassworm_luca-stealer_mespinoza_njrat_remcos_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5536
    • F:\Program Files (x86)\STNetSpeeder\Client.exe
      "F:\Program Files (x86)\STNetSpeeder\Client.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2324
      • F:\Program Files (x86)\STNetSpeeder\Updater.exe
        "F:\Program Files (x86)\STNetSpeeder\Updater.exe" -path="F:\Program Files (x86)\STNetSpeeder" -silent=y -self=y
        3⤵
        • Enumerates connected drives
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3868
        • F:\Program Files (x86)\STNetSpeeder\Client.exe
          "F:\Program Files (x86)\STNetSpeeder\Client.exe" -path="F:\Program Files (x86)\STNetSpeeder" -silent=y -self=y
          4⤵
          • Enumerates connected drives
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:5968

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Client.exe

        • Path F:\Program Files (x86)\STNetSpeeder\Client.exe
        • Size 3.9MB
        • SHA256 d38c5c8d13f5acc01a2fcc09b385bbe81f65494a132ae2503ba7d6a0c270cf19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Client.exe

        • Path F:\Program Files (x86)\STNetSpeeder\Client.exe
        • Size 3.9MB
        • SHA256 61b464384e258bc6914e89d220cd59c583ab62120f07258150b3cd6a343baeb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Client_INFO.20260819-073837.2324.txt

        • Path F:\Program Files (x86)\STNetSpeeder\Log\Client_INFO.20260819-073837.2324.txt
        • Size 180B
        • SHA256 36f40df6b091f678491f413f85fa1973c11e40e8891af8247ae0c44d48f628a0
        • MD5 SHA1 SHA512 TLSH

        Updater.exe

        • Path F:\Program Files (x86)\STNetSpeeder\Updater.exe
        • Size 3.4MB
        • SHA256 7ef1949369a136607857d5fa123a0044f100c3c9aab470bb9215f6848504b912
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 43B
        • SHA256 72aebada9525296dd28a0ab65ae821ce4c367f71b3d8b467608375679264cd54
        • MD5 SHA1 SHA512

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 17KB
        • SHA256 32680c1527c7c5d76d47ba437b45ebd1a7ae5e19299e4042f7feb195bdf5aa80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 11KB
        • SHA256 fb65af9a2c2cf57bee4a47f36d48e53668708011707760b141273f002dfe9175
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 10KB
        • SHA256 c3b68697df3882596bd82e7c9018ae4b9768ceb5008723d82e2163d6ade99646
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 13KB
        • SHA256 c2bdc7725ed64e07f009ae9d452a6b014129c5fe00737a7068845a4710898e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 15KB
        • SHA256 ae91b7f31522e559a41433542d5cf657ec7b81c86e568fcf4e0018a679c9fb65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 16KB
        • SHA256 3d2a555bbc70c04ec9b1a15e8ecce8166a9facfdd82e1b133971c4299dbf4e26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 15KB
        • SHA256 63b123a31bd448223789ed7cbeb4ec605c434d87306501845179dd0286e1547c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cfg.dat

        • Path F:\Program Files (x86)\STNetSpeeder\cfg.dat
        • Size 16KB
        • SHA256 5183097ee73886eb28db493ff8ebf033687bc0613eb58c06337b8527eec005c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        seo.dat

        • Path F:\Program Files (x86)\STNetSpeeder\seo.dat
        • Size 12B
        • SHA256 fc364af26c68714a5ce7f8435a9671933c531675526b69d5a7f1f47b1b45a4a9
        • MD5 SHA1 SHA512

        uninst.exe

        • Path F:\Program Files (x86)\STNetSpeeder\uninst.exe
        • Size 350KB
        • SHA256 d00a4dd4d00d6ac4c9a01d100bf1b3b4e5fe401d778fe8dbb5040c59acc0da7b
        • MD5 SHA1 SHA512 SSDEEP TLSH