Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/09/2026, 12:00
General
- Target 2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
- Size 1.5MB
- Sample260930-n6m3xaee78
- SHA256 d54d590acc884097a74ff9396a4ae9e7667e4016a9977371714db13d574d3427
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 6 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_41648231e6002ef1ec73d4ef05e90eb7_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
GameInputSvc.exe
alg.exe
msdtc.exe
memory/1264-251-0x000001E55DB70000-0x000001E55DBD6000-memory.dmp
memory/1264-250-0x000001E55DB70000-0x000001E55DBD6000-memory.dmp
memory/1264-249-0x00007FF73EDC0000-0x00007FF73EEDA000-memory.dmp
memory/1276-1-0x0000000003160000-0x00000000031C9000-memory.dmp
memory/1276-0-0x0000000002F60000-0x0000000003002000-memory.dmp
memory/1276-7-0x0000000003160000-0x00000000031C9000-memory.dmp
memory/2416-15-0x00007FF6F5430000-0x00007FF6F5553000-memory.dmp
memory/2416-17-0x000002C405630000-0x000002C405696000-memory.dmp
memory/2416-64-0x00007FF6F5430000-0x00007FF6F5553000-memory.dmp
memory/2416-18-0x000002C405630000-0x000002C405696000-memory.dmp
memory/2416-16-0x000002C405630000-0x000002C405696000-memory.dmp
memory/2920-40-0x000002280E9F0000-0x000002280EA56000-memory.dmp
memory/2920-39-0x000002280E9F0000-0x000002280EA56000-memory.dmp
memory/2920-38-0x000002280E9F0000-0x000002280EA56000-memory.dmp
memory/2920-37-0x000002280E740000-0x000002280E8CB000-memory.dmp
memory/3004-59-0x00000153BB7C0000-0x00000153BB826000-memory.dmp
memory/3004-58-0x00000153BB560000-0x00000153BB6EB000-memory.dmp
memory/3004-60-0x00000153BB7C0000-0x00000153BB826000-memory.dmp
memory/3520-31-0x000001CE7C650000-0x000001CE7C6B6000-memory.dmp
memory/3520-29-0x000001CE7C650000-0x000001CE7C6B6000-memory.dmp
memory/3520-30-0x000001CE7C650000-0x000001CE7C6B6000-memory.dmp
memory/3520-28-0x000001CE7C3D0000-0x000001CE7C55B000-memory.dmp
memory/4508-244-0x000001AECCC20000-0x000001AECCC86000-memory.dmp
memory/4508-246-0x000001AECCC20000-0x000001AECCC86000-memory.dmp
memory/4508-243-0x00007FF7D47D0000-0x00007FF7D4899000-memory.dmp
memory/4692-47-0x000001A8A7010000-0x000001A8A7076000-memory.dmp
memory/4692-55-0x00007FF7C6D40000-0x00007FF7C6EA8000-memory.dmp
memory/4692-53-0x000001A8A7010000-0x000001A8A7076000-memory.dmp
memory/4692-48-0x000001A8A7010000-0x000001A8A7076000-memory.dmp
memory/4692-46-0x00007FF7C6D40000-0x00007FF7C6EA8000-memory.dmp
memory/5384-237-0x000001AC07060000-0x000001AC070C6000-memory.dmp
memory/5384-236-0x000001AC07060000-0x000001AC070C6000-memory.dmp
memory/5384-235-0x00007FF7D47D0000-0x00007FF7D4899000-memory.dmp