Analysis
- max time kernel
110s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/09/2026, 12:24
Behavioral task
behavioral1
Sample
2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe
- Size 5.4MB
- Sample260903-plfnrssyaz
- SHA256 d25913ba040d70de14254085df9b61f8b4f940568d2b1815b473b52feb456abb
- MD5 4da4a76e7f7157e0066b5396c83ac280
- SHA1 ed449b1c55f2c5f6abaf8534f8b2315520f1b052
- SHA512 b924a7f761354ad9b927b5f190a5ab9d40056360e07923e75c12cc6a8d4f3da43ded29942e77d2fd65506cb3d9664cd8b8f51dcc0c1467c60956ceb0977b6ee7
- SSDEEP 49152:Fl/ijN5j2Xsl3RJ3LHobUQDgok36O4Gc1qkqGOyCPO04tqC0DKA0D2itrqEipYq:FlerjesRJ8YQU/6V1qfVPO0610QZ86
- TLSH T192464B01A3A24123D8616574C89F774856307F742F3AD3EB6E06BA69BE327D1C836379
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
darkcomet
Attributes
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
rc4.plain
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Detect Neshta payload 3 IoCs
resource yara_rule behavioral2/files/0x0009000000019cc9-5.dat family_neshta behavioral2/files/0x000200000001b313-11.dat family_neshta behavioral2/files/0x000500000001ac2e-1239.dat family_neshta - Detects executables packed with ASPack 6 IoCs
resource yara_rule behavioral2/memory/5736-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019cc9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001ac2e-1239.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5736-1398-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/108-1453-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 108 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5736 2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe 108 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_4da4a76e7f7157e0066b5396c83ac280_amadey_darkcomet_elex_ransomhub_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5736
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.4MB
- SHA256 d25913ba040d70de14254085df9b61f8b4f940568d2b1815b473b52feb456abb
- MD5 4da4a76e7f7157e0066b5396c83ac280
- SHA1 ed449b1c55f2c5f6abaf8534f8b2315520f1b052
- SHA512 b924a7f761354ad9b927b5f190a5ab9d40056360e07923e75c12cc6a8d4f3da43ded29942e77d2fd65506cb3d9664cd8b8f51dcc0c1467c60956ceb0977b6ee7
- SSDEEP 49152:Fl/ijN5j2Xsl3RJ3LHobUQDgok36O4Gc1qkqGOyCPO04tqC0DKA0D2itrqEipYq:FlerjesRJ8YQU/6V1qfVPO0610QZ86
- TLSH T192464B01A3A24123D8616574C89F774856307F742F3AD3EB6E06BA69BE327D1C836379
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.0MB
- SHA256 d79aee08a4a43553fd91155631cb00f3c36125b4c7041c7ea75e301aa799f6e8
- MD5 84175451613583797122faae5f7af50d
- SHA1 3429704dad3bb54460ef48fa4decb1330a8641c5
- SHA512 8632f760acec339e048b94ff05721bd09d3bd40183c3a0b3e26ba1a795011ef7432c03d24a08ecd969f96b3b33f92e6d9ead4e785f5c630f7bfbea7a46119ada
- SSDEEP 98304:FlerjesRJ8YQU/6V1qfVPO0610QZ86Gjo:urj578YQL1qfVPc1V+6Qo
- TLSH T112564B01E3A14123D4626474C89F77489A307F742F3AD7EB6A06BA69BE327D1C836375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 5.5MB
- SHA256 e0e038c34f6f644a8af7b98f87f8e0ebc45daa56fe96371c16566b109cd6a7b8
- MD5 864caeacb520c8d881b0ef2fcb8a5a69
- SHA1 c66d02bf648288d0f2385faa9c6156d86e76f19d
- SHA512 f74aeaa59a1e301ac6b710d22f2cc6531bb8d51bc404cd2901f1b197e29a4b1b0d26d3c03278f3618b3609655885db840bf344a62ae3070ed15ea8371820ca33
- SSDEEP 49152:Fl/ijN5j2Xsl3RJ3LHobUQDgok36O4Gc1qkqGOyCPO04tqC0DKA0D2itrqEipYqt:FlerjesRJ8YQU/6V1qfVPO0610QZ86Y
- TLSH T18F463B01A3A24123D8616570CC9F774856307F742F3AD7EB6E06BA69BE327D1C836279
- MD5 SHA1 SHA512 SSDEEP TLSH