Overview

overview

8

Static

static

3

2026-09-24...te.exe

windows10-2004-x64

8

2026-09-24...te.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 05:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
  • Size 1.7MB
  • Sample260925-gdht6a1crd
  • SHA256 0695e16b918da4a591a6fe2287798671792c7674c30309e10a6b42d30394a994
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_86ba8367582af1848f0ffecfa59df641_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3916
    • C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
      "adobearm32.exe "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4260
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        3⤵
          PID:1632
        • C:\ProgramData\Adobe\ARM\S\14136\AdobeARMHelper.exe
          "C:\ProgramData\Adobe\ARM\S\14136\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\14136" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4156
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\14136" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
            4⤵
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2172
      • C:\Windows\SysWOW64\eventviewer.exe
        "C:\Windows\system32\eventviewer.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5464
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 2024
          3⤵
          • Program crash
          PID:1468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1492
        2⤵
        • Program crash
        PID:1456
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3916 -ip 3916
      1⤵
        PID:3300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5464 -ip 5464
        1⤵
          PID:1556

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 82B
              • SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\14136\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
              • Size 808B
              • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 88c671dbe2f52ca4bb4df243d70b5f9d8c63f7399275e59579b1fc3c24691abf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 3220255e531b0180ca71f5131e5e2a2952e4ab473305c3c14bfa50e58dbd2665
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 f48cc895da3778ce33b94b910e99456c2be4e32a448ffec77f41e6b67b8d01fd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 5f59c273582d1f7461890515bcdfcd0306152ac82e7b5129e9212fde0518d275
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D07CF1B9FF136D4730540DBA899C45D1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D07CF1B9FF136D4730540DBA899C45D1
              • Size 177KB
              • SHA256 81e90807b2695a8d62c5ee4d4972fe94359d934ae275c737e1caccaec35a4b72
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 701B
              • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
              • Size 192B
              • SHA256 f1c756d699719a6e305cb0785300975f289c5d41497617094485c68ebba49493
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 43d33a31e4ac62e3d9caba335bb6e90cd04231637ac5b00bffea0899dbf4f5e6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 133e6ef002d2f30bba5e95ad7b49892ef29e218b4518b6cdf4562eab679184da
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 d5655f7a023e23f2c5c37aeee492c29effec1267b601e6bc5e84a2b27a8f3f0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 718e0e71af20c2d833a678a9e0165679c84160986aac82316c61000249f19f67
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              D07CF1B9FF136D4730540DBA899C45D1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D07CF1B9FF136D4730540DBA899C45D1
              • Size 246B
              • SHA256 c4c3330d0e7e082cf72d3768ab8de619a56a2b2277b1ddb5bcfd3a4cba6efd6e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 192B
              • SHA256 b0752fbabb6b9f916891bf61145c03d7d95c4e1e1b04dafeb0eda201a0887f22
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 334B
              • SHA256 d57d25386760ee5ddd0cbc84bd393f7c9693b08b694b0cdcb68235fa8d4201d4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp97C2.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp97C2.tmp
              • Size 5KB
              • SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpB5FA.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpB5FA.tmp
              • Size 5KB
              • SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpB697.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpB697.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              TmpBD01.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpBD01.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpE8E5.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpE8E5.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              adobearm32.exe
              • Path C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
              • Size 1.5MB
              • SHA256 3fb224a6269885a6ea317388e27f854fe44bdf2652b405f321d00b358a839d81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redevlist.dat
              • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
              • Size 191KB
              • SHA256 2885530cecf2a641870b003cf14136e0489a5849fde9718828b86272afbc82d4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eventviewer.exe
              • Path C:\Windows\SysWOW64\eventviewer.exe
              • Size 88KB
              • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 472B
              • SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 594B
              • SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 724B
              • SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Windows\Temp\ArmUI.ini
              • Size 234KB
              • SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download