856c2306c3fb336fdf44e2b56bd24e2c52181e43f6ab70561f469f417ce09698

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_85be490b5c8af45da4eb15ea47205796_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.4MB
Sample260905-fe7z1axamd
SHA256 856c2306c3fb336fdf44e2b56bd24e2c52181e43f6ab70561f469f417ce09698
MD5 85be490b5c8af45da4eb15ea47205796
SHA1 2f80378f34dbaca13e4fa9cb9b7cad8fc243d35b
SHA512 2ab3803894338da984deb93263d2aa51a3b2a9ceb662263b092bf61cadfaebcb2237051dfc634c706c0333e68358e85b7da698e3f6f08f6d3b3071b6b3b61745
SSDEEP 24576:+t22UWyIVFJeukZTaIdhN0VJNBNbQb6lq61cT:U22UWycBoaI3UjbmC9GT
TLSH
T19465AF2079519236F6B300B2DDFEAA6E512CBD61036554C7A3C8393F1A62ED23B37257
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-09-04_85be490b5c8af45da4eb15ea47205796_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2136	816	WerFault.exe	87
3968	816	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_85be490b5c8af45da4eb15ea47205796_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-04_85be490b5c8af45da4eb15ea47205796_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_85be490b5c8af45da4eb15ea47205796_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 852
  2⤵
  - Program crash
  PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 816 -s 852
  2⤵
  - Program crash
  PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 816 -ip 816
1⤵
PID:4616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 816 -ip 816
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads