Overview

overview

7

Static

static

3

2026-09-28...er.exe

windows10-2004-x64

7

2026-09-28...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/09/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
  • Size 14.8MB
  • Sample260929-ph3dcsz1c1
  • SHA256 87db211d39b0afff67ac5f5ed8e7a48d8f67319d8b7168a4213c3596ba0bfc2b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 47 IoCs
  • Drops file in Windows directory 43 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura 1.2.80.0\install\SetupKassa-1.2.80.0.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1790443703 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:1644
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5980
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F33410753ACDB92A7DC493A2C2F84234 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Users\Admin\AppData\Local\Temp\2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-28_05f4aad1ec1cec291d6baf32c020946a_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe" /groupsextract:101; /out:"C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura\prerequisites" /callbackid:3692
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4376
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura\prerequisites\NETProvider-4.1.0.0.msi"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:4088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3692 -s 1552
        3⤵
        • Program crash
        PID:2388
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3772
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7179F37EDFFE58D7956EB20793DE95BF
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5984
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9802A1B86F7B0709EAEBF7BE610FE920 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3380
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7804BC1FA765E8C42BE2536A39597455
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4928
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 0ECD3EA082520D529F71007EA52D9BD1 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2812
      • C:\Windows\syswow64\MsiExec.exe
        "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\DataMagic\Kassa\asignRKCom.dll"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1912
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3692 -ip 3692
      1⤵
        PID:3352

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59f081.rbs
            • Path C:\Config.Msi\e59f081.rbs
            • Size 491KB
            • SHA256 322ca08990afca8a98b4b0b40d2052ae1c8a21a78eb1b190cc825ac5be17e077
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59f086.rbs
            • Path C:\Config.Msi\e59f086.rbs
            • Size 1.9MB
            • SHA256 5771c131440ab29987698139220365206896ce34efcae2bfbf63952c651c26db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Kassa.exe
            • Path C:\Program Files (x86)\DataMagic\Kassa\Kassa.exe
            • Size 2.0MB
            • SHA256 ba60eccfa8a91b6c0d316e184a31588cd44f38d6d1b268de030c3abafdc212ea
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Kassa_Admin.exe
            • Path C:\Program Files (x86)\DataMagic\Kassa\Kassa_Admin.exe
            • Size 1.9MB
            • SHA256 8a51a97b98fff20ef06ef9fa66934cf994ca8494922fbd0664ffb0beafdf5243
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            asignRKCom.dll
            • Path C:\Program Files (x86)\DataMagic\Kassa\asignRKCom.dll
            • Size 1.2MB
            • SHA256 f144ad8208be0cee4de45868df646546ae0a16d828501934f7bf97b6a751cf63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            updater.ini
            • Path C:\Program Files (x86)\DataMagic\Kassa\updater.ini
            • Size 442B
            • SHA256 2e1f91e0bc6a8d3f68c65069b4814be13fcdc6e456f13e6fff6d8aa899930782
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSI80E0.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI80E0.tmp
            • Size 936KB
            • SHA256 aeda49baf2d79da2f7a9266f1fb7884111c2620e187090321f5278af5131c996
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI82B8.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI82B8.tmp
            • Size 1.1MB
            • SHA256 e5aff7492b86b6461591e93213b33c639db991b04ac63b5d07240d1777e554ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSI8346.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\MSI8346.tmp
            • Size 881KB
            • SHA256 7f4713f31958704586a9173759dc568dd48b21de022eeae19e5152ae2d011b4d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIa0466.LOG
            • Path C:\Users\Admin\AppData\Local\Temp\MSIa0466.LOG
            • Size 54KB
            • SHA256 ed70a9bf8a6ba5aa0526ece920ea543ed53370f584f91d630d974c2839775398
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            migrate_props.txt
            • Path C:\Users\Admin\AppData\Local\Temp\migrate_props.txt
            • Size 7KB
            • SHA256 f04ea8c5839251b3773f8ccf7e8d3a2a0113d3e24c3b4d7d7b117f8e80a1dc04
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupKassa-1.2.80.0.msi
            • Path C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura 1.2.80.0\install\SetupKassa-1.2.80.0.msi
            • Size 4.4MB
            • SHA256 63c3bc0fb2dc9e3ba4872852af306fd981f2ebe69e14c8150586d0f1cdd5d539
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SetupKassa-1.2.80.01.cab
            • Path C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura 1.2.80.0\install\SetupKassa-1.2.80.01.cab
            • Size 5.8MB
            • SHA256 9c11588d114aa939ccfe828458e5158cf7fdfb43ce550199d0299d2874ca977d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            NETProvider-4.1.0.0.msi
            • Path C:\Users\Admin\AppData\Roaming\Data Magic Datenservice GmbH\Kassa für Amicron Faktura\prerequisites\NETProvider-4.1.0.0.msi
            • Size 796KB
            • SHA256 a921660a7d45468b3501f6792ed8cb3321c5dfffd6eacae919b5565b9107286f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIA9C.tmp
            • Path C:\Windows\Installer\MSIA9C.tmp
            • Size 963KB
            • SHA256 708a260fd3e1d6763150806d3c5b3ad51f5d4c7693e5f3585efaa334f3a819bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSIF68C.tmp
            • Path C:\Windows\Installer\MSIF68C.tmp
            • Size 152KB
            • SHA256 3585ccf92c60150cf863e26c0eb2948e206841ca8ff91dac092cf567eef0880b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FirebirdSql.Data.FirebirdClient.dll
            • Path C:\Windows\assembly\tmp\A0LX9WKG\FirebirdSql.Data.FirebirdClient.dll
            • Size 682KB
            • SHA256 cab9aa360f4bc0cd8ae493b5e0efbe5bd2a22750faf84da06ba70ad7f203e2f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5980-71-0x00000153BA370000-0x00000153BA420000-memory.dmp
            Download