Overview

overview

8

Static

static

3

2026-09-24...te.exe

windows10-2004-x64

8

2026-09-24...te.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/09/2026, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
  • Size 1.7MB
  • Sample260925-gdht6a1crd
  • SHA256 0695e16b918da4a591a6fe2287798671792c7674c30309e10a6b42d30394a994
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3452
    • C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
      "adobearm32.exe "
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        3⤵
          PID:2820
        • C:\ProgramData\Adobe\ARM\S\14132\AdobeARMHelper.exe
          "C:\ProgramData\Adobe\ARM\S\14132\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\14132" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\14132" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
            4⤵
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4268
      • C:\Windows\SysWOW64\eventviewer.exe
        "C:\Windows\system32\eventviewer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 1436
          3⤵
          • Program crash
          PID:1536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 1096
        2⤵
        • Program crash
        PID:2248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3452 -ip 3452
      1⤵
        PID:536
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4220 -ip 4220
        1⤵
          PID:824

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 82B
              • SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\14132\AdobeARM.msi
              • Size 1.0MB
              • SHA256 561af66f90a5104753bca640f6b1d2b2e7cdea64fc8f11ef2cd62b3c9ce36743
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\14132\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
              • Size 808B
              • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 88c671dbe2f52ca4bb4df243d70b5f9d8c63f7399275e59579b1fc3c24691abf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 3220255e531b0180ca71f5131e5e2a2952e4ab473305c3c14bfa50e58dbd2665
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 f48cc895da3778ce33b94b910e99456c2be4e32a448ffec77f41e6b67b8d01fd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 5f59c273582d1f7461890515bcdfcd0306152ac82e7b5129e9212fde0518d275
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D07CF1B9FF136D4730540DBA899C45D1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D07CF1B9FF136D4730540DBA899C45D1
              • Size 177KB
              • SHA256 81e90807b2695a8d62c5ee4d4972fe94359d934ae275c737e1caccaec35a4b72
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 701B
              • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
              • Size 192B
              • SHA256 3a0fd2659acc4423a8c02a2725589d59692bb5c409085732e3341cc3f3b4ff4f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 2163dcd64c44872f3f273b93d216a19f9e52abd613f5e5d57c35bf07e672ff36
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 0451f97163c67ba2d2b8534afe0d3c38f42be20f37a6916bac47dc7b3afcb876
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 a024179c4a08f38f579750b43476a6707660dfa58e8c3094c7554ea80f57850d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 bf2fcca209337064ce03fe19ef35005830c874fd8bc99276eb5241f67e205fbc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D07CF1B9FF136D4730540DBA899C45D1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
              • Size 246B
              • SHA256 2d655ea970ae8bf66291f38cd33899a13c4c77b41cac55fc4d6841ce4e4ab4eb
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D07CF1B9FF136D4730540DBA899C45D1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
              • Size 246B
              • SHA256 31998f9d08e3dbbad0efc3a340b957bff5365166eb7bf9b2988e30fe3220633b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 192B
              • SHA256 d7e03ca8a856e1b0f4aa70271b7f1cc6f3e5ef56153ba86e7c80d5dfa4c98327
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 334B
              • SHA256 09c5252be812205d5c01924f6ad6b8d46ddac8c9a58f3422b8deda31aa3ec75d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Rdr14136.txt
              • Path C:\Users\Admin\AppData\Local\Temp\Rdr14136.txt
              • Size 13B
              • SHA256 b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
              • MD5 SHA1 SHA512
              Submit Download

              ReportOwner14136.txt
              • Path C:\Users\Admin\AppData\Local\Temp\ReportOwner14136.txt
              • Size 4B
              • SHA256 69bf0bc46f51b33377c4f3d92caf876714f6bbbe99e7544487327920873f9820
              • MD5 SHA1 SHA512
              Submit Download

              Tmp28.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp28.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Tmp34F7.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp34F7.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp922.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp922.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpE327.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpE327.tmp
              • Size 5KB
              • SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpFFBA.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpFFBA.tmp
              • Size 5KB
              • SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              adobearm32.exe
              • Path C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
              • Size 1.5MB
              • SHA256 3fb224a6269885a6ea317388e27f854fe44bdf2652b405f321d00b358a839d81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redevlist.dat
              • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
              • Size 191KB
              • SHA256 2885530cecf2a641870b003cf14136e0489a5849fde9718828b86272afbc82d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eventviewer.exe
              • Path C:\Windows\SysWOW64\eventviewer.exe
              • Size 88KB
              • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 472B
              • SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 594B
              • SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 724B
              • SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Windows\Temp\ArmUI.ini
              • Size 234KB
              • SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download