Analysis
- max time kernel
84s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 14:55
General
- Target 2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe
- Size 3.3MB
- Sample260930-sax1fstyhx
- SHA256 6c9c88aa1b0c9d34653dd96989bc62908be701aeedb0b31933618ec455917dfd
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 23 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_f5ee0bee0bbe4ec923a7d3864317d681_amadey_darkgate_elex_luca-stealer_lynx_magniber_njrat.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 920 924 932 8192 928 9042⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
DiagnosticsHub.StandardCollector.Service.exe
FXSSVC.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
SearchIndexer.exe
SensorDataService.exe
Spectrum.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/452-27-0x0000022F80C50000-0x0000022F80CB6000-memory.dmp
memory/452-94-0x00007FF6876E0000-0x00007FF6877C4000-memory.dmp
memory/452-26-0x00007FF6876E0000-0x00007FF6877C4000-memory.dmp
memory/452-28-0x0000022F80C50000-0x0000022F80CB6000-memory.dmp
memory/812-35-0x000001E298160000-0x000001E2981C6000-memory.dmp
memory/812-36-0x000001E298160000-0x000001E2981C6000-memory.dmp
memory/812-42-0x00007FF61BAE0000-0x00007FF61BD68000-memory.dmp
memory/812-34-0x00007FF61BAE0000-0x00007FF61BD68000-memory.dmp
memory/812-40-0x000001E298160000-0x000001E2981C6000-memory.dmp
memory/816-115-0x00000260E7E20000-0x00000260E7E86000-memory.dmp
memory/816-168-0x00007FF7FFF30000-0x00007FF7FFFD8000-memory.dmp
memory/816-117-0x00007FF7FFF30000-0x00007FF7FFFD8000-memory.dmp
memory/816-116-0x00000260E7E20000-0x00000260E7E86000-memory.dmp
memory/964-140-0x000001C778C00000-0x000001C778C66000-memory.dmp
memory/964-141-0x00007FF759F40000-0x00007FF75A264000-memory.dmp
memory/964-142-0x000001C778C00000-0x000001C778C66000-memory.dmp
memory/964-202-0x00007FF759F40000-0x00007FF75A264000-memory.dmp
memory/996-271-0x00007FF706A10000-0x00007FF706B4B000-memory.dmp
memory/996-209-0x000002370A920000-0x000002370A986000-memory.dmp
memory/996-208-0x00007FF706A10000-0x00007FF706B4B000-memory.dmp
memory/996-206-0x000002370A920000-0x000002370A986000-memory.dmp
memory/1264-87-0x00000171A3FE0000-0x00000171A4046000-memory.dmp
memory/1264-86-0x00000171A4080000-0x00000171A420B000-memory.dmp
memory/1264-88-0x00000171A3FE0000-0x00000171A4046000-memory.dmp
memory/1368-399-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-391-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-396-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-395-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-397-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-393-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-392-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-398-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-400-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-394-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1368-401-0x000001AC17470000-0x000001AC17480000-memory.dmp
memory/1480-123-0x0000017B13FE0000-0x0000017B14046000-memory.dmp
memory/1480-193-0x00007FF7B6240000-0x00007FF7B66AD000-memory.dmp
memory/1480-125-0x0000017B13FE0000-0x0000017B14046000-memory.dmp
memory/1480-124-0x00007FF7B6240000-0x00007FF7B66AD000-memory.dmp
memory/1480-180-0x00007FF7B6240000-0x00007FF7B66AD000-memory.dmp
memory/1480-191-0x0000017B13FE0000-0x0000017B14046000-memory.dmp
memory/1632-181-0x00007FF74CE80000-0x00007FF74D13E000-memory.dmp
memory/1632-266-0x00007FF74CE80000-0x00007FF74D13E000-memory.dmp
memory/1652-47-0x000002B8F7840000-0x000002B8F78A6000-memory.dmp
memory/1652-45-0x000002B8F7590000-0x000002B8F771B000-memory.dmp
memory/1652-46-0x000002B8F7840000-0x000002B8F78A6000-memory.dmp
memory/1956-15-0x00007FF6B4E20000-0x00007FF6B4F07000-memory.dmp
memory/1956-16-0x00000263DE340000-0x00000263DE3A6000-memory.dmp
memory/1956-61-0x00007FF6B4E20000-0x00007FF6B4F07000-memory.dmp
memory/1956-18-0x00000263DE340000-0x00000263DE3A6000-memory.dmp
memory/2236-132-0x00007FF783560000-0x00007FF78360B000-memory.dmp
memory/2236-134-0x000001BC2B740000-0x000001BC2B7A6000-memory.dmp
memory/2236-133-0x000001BC2B740000-0x000001BC2B7A6000-memory.dmp
memory/2236-184-0x00007FF783560000-0x00007FF78360B000-memory.dmp
memory/2316-218-0x00007FF6473B0000-0x00007FF647704000-memory.dmp
memory/2316-222-0x000002445F720000-0x000002445F730000-memory.dmp
memory/2316-217-0x000002445E7F0000-0x000002445E856000-memory.dmp
memory/2316-272-0x00007FF6473B0000-0x00007FF647704000-memory.dmp
memory/2316-216-0x000002445E7F0000-0x000002445E856000-memory.dmp
memory/2316-238-0x000002445F950000-0x000002445F960000-memory.dmp
memory/2316-267-0x0000024468F70000-0x0000024468F78000-memory.dmp
memory/2316-254-0x0000024467D10000-0x0000024467D18000-memory.dmp
memory/2364-150-0x00007FF62BC00000-0x00007FF62BDEF000-memory.dmp
memory/2364-151-0x0000022595970000-0x00000225959D6000-memory.dmp
memory/2364-205-0x00007FF62BC00000-0x00007FF62BDEF000-memory.dmp
memory/2364-152-0x0000022595970000-0x00000225959D6000-memory.dmp
memory/2588-74-0x00007FF7A7BF0000-0x00007FF7A7D04000-memory.dmp
memory/2588-149-0x00007FF7A7BF0000-0x00007FF7A7D04000-memory.dmp
memory/2588-75-0x000001C9EB430000-0x000001C9EB496000-memory.dmp
memory/2588-76-0x000001C9EB430000-0x000001C9EB496000-memory.dmp
memory/2636-62-0x00007FF6FA540000-0x00007FF6FA6A8000-memory.dmp
memory/2636-63-0x0000015816C30000-0x0000015816C96000-memory.dmp
memory/2636-64-0x0000015816C30000-0x0000015816C96000-memory.dmp
memory/2636-69-0x0000015816C30000-0x0000015816C96000-memory.dmp
memory/2636-71-0x00007FF6FA540000-0x00007FF6FA6A8000-memory.dmp
memory/2964-170-0x000001A0D02E0000-0x000001A0D0346000-memory.dmp
memory/2964-175-0x000001A0D02E0000-0x000001A0D0346000-memory.dmp
memory/2964-171-0x00007FF62E020000-0x00007FF62E449000-memory.dmp
memory/2964-169-0x000001A0D02E0000-0x000001A0D0346000-memory.dmp
memory/2964-177-0x00007FF62E020000-0x00007FF62E449000-memory.dmp
memory/3272-159-0x000001D7E8310000-0x000001D7E8376000-memory.dmp
memory/3272-160-0x000001D7E8310000-0x000001D7E8376000-memory.dmp
memory/3272-161-0x00007FF7F0F10000-0x00007FF7F109F000-memory.dmp
memory/3272-215-0x00007FF7F0F10000-0x00007FF7F109F000-memory.dmp
memory/3532-165-0x0000000000400000-0x000000000054A000-memory.dmp
memory/3532-103-0x0000000000670000-0x00000000006D9000-memory.dmp
memory/3532-108-0x0000000000670000-0x00000000006D9000-memory.dmp
memory/3532-109-0x0000000000400000-0x000000000054A000-memory.dmp
memory/3568-95-0x00007FF63D0F0000-0x00007FF63D1DA000-memory.dmp
memory/3568-96-0x0000024FA2AD0000-0x0000024FA2B36000-memory.dmp
memory/3568-97-0x0000024FA2AD0000-0x0000024FA2B36000-memory.dmp
memory/3568-158-0x00007FF63D0F0000-0x00007FF63D1DA000-memory.dmp
memory/3664-185-0x00000233211F0000-0x0000023321256000-memory.dmp
memory/3664-269-0x00007FF6E52E0000-0x00007FF6E57BD000-memory.dmp
memory/3664-187-0x00000233211F0000-0x0000023321256000-memory.dmp
memory/3664-186-0x00007FF6E52E0000-0x00007FF6E57BD000-memory.dmp
memory/4104-196-0x000002AA45180000-0x000002AA451E6000-memory.dmp
memory/4104-197-0x000002AA45180000-0x000002AA451E6000-memory.dmp
memory/4104-198-0x00007FF61FEC0000-0x00007FF6203EB000-memory.dmp
memory/4104-270-0x00007FF61FEC0000-0x00007FF6203EB000-memory.dmp
memory/4184-54-0x000001E71F930000-0x000001E71F996000-memory.dmp
memory/4184-55-0x000001E71F930000-0x000001E71F996000-memory.dmp
memory/4184-53-0x000001E71F6D0000-0x000001E71F85B000-memory.dmp
memory/4752-0-0x00000000030F0000-0x00000000031A6000-memory.dmp
memory/4752-7-0x00000000031B0000-0x0000000003219000-memory.dmp
memory/4752-1-0x00000000031B0000-0x0000000003219000-memory.dmp