9b7a89722fd4690b4d042e650714ececde4599203d113103eaa1e3e92b47eec9

General

Target
2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Size 5.4MB
Sample261002-qml3lsba63
SHA256 9b7a89722fd4690b4d042e650714ececde4599203d113103eaa1e3e92b47eec9
MD5 62d99249095e40388f71b7af2c6cc834
SHA1 342ccd7ec7f03cb8b7515918448562dd85c0e881
SHA512 902c173bd27a6e907e4926d4791b0c025e0bbe2e932eba0f449e0067003e1a4ce4d53d0c7f9f401d6269454544e5db0ce9b44f1fa2afe67c6b976436874d969f
SSDEEP 49152:M7zLNHEgkjKYHrJg1NNNRNNNTONv/TO98VChBtzysUVap/Uv/TO98VChBtzysUV3:yPREgWsbtzysiCbtzysiGj
TLSH
T14F46BE00AFA16836FD3245760DAA23664438FE31F74205DF9293F61E5761DF229372AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/memory/3104-9-0x0000000010000000-0x00000000100FC000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Executes dropped EXE 2 IoCs

pid	Process
3104	BDSubWiz.exe
3608	knswlf.exe

Loads dropped DLL 2 IoCs

pid	Process
3104	BDSubWiz.exe
3608	knswlf.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3204	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BDSubWiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	knswlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3204	cmd.exe
4392	PING.EXE
1688	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4392	PING.EXE
1688	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3104	BDSubWiz.exe
3104	BDSubWiz.exe
3608	knswlf.exe
3608	knswlf.exe
5028	svchost.exe
5028	svchost.exe
5028	svchost.exe
5028	svchost.exe
2356	dllhost.exe
2356	dllhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3204	5044	2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe	89
PID 3204 wrote to memory of 4392	3204	cmd.exe	91
PID 3204 wrote to memory of 1688	3204	cmd.exe	92
PID 3204 wrote to memory of 3104	3204	cmd.exe	93
PID 3608 wrote to memory of 5028	3608	knswlf.exe	95
PID 3608 wrote to memory of 5028	3608	knswlf.exe	95
PID 5028 wrote to memory of 2356	5028	svchost.exe	97
PID 5028 wrote to memory of 2356	5028	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 -n 2 >nul && del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-10-01_62d99249095e40388f71b7af2c6cc834_amadey_darkgate_elex_luca-stealer_medusalocker_njrat_remcos.exe" && cd /d "C:\Users\Admin\AppData\Local\Temp\MyApp\" && ping 127.0.0.1 -n 2 >nul && "C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4392
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
    "C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3104

C:\Users\Default\AppData\Local\Microsoft\Office\13.0\knswlfx\knswlf.exe
C:\Users\Default\AppData\Local\Microsoft\Office\13.0\knswlfx\knswlf.exe -svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\SysWOW64\svchost.exe -k netsvcs
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\dllhost.exe
    "C:\Windows\SysWOW64\dllhost.exe" -ks
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BDSubWiz.exe

Path C:\Users\Admin\AppData\Local\Temp\MyApp\BDSubWiz.exe
Size 912KB
SHA256 84184943ae6d94b547885764b0f361e9dd9d74a517ad10621b1ef3d0eecf6702
MD5 a1b7601ff2db87b599149b2b00ff64de
SHA1 27f6dd3e46a769f650840cf42ce94e2b66a55abc
SHA512 f02fe55d61a879105ce49f8113c619278b36cd60d3981df685c7e132ee9c4ae782d43139af89624be145bf5de8a68b28420e8b5b8f4aee8b21c5a37993bfccfa
SSDEEP 24576:yE/TOVq28VC9ruYau/7y/kwbiJ4Rap0+C1c:J/TO98VChBtzysUVap/Uc
TLSH
T1D6159F2175C1A037F57301328FBD962D451CB8220B15AADBB3E8172D9B69AF13E3265B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dat

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dat
Size 1.3MB
SHA256 d241c960565dcb04ed53e19649f798a652b82dd772a547775732e60642869752
MD5 3e3137f642b0f06a59d1b32624cfe1a5
SHA1 c962098eb4371f3cae8866c5bec3fc00f98ed2b8
SHA512 984c6d7e8ebcdeacb3490a2b53e8e92f6d10302ef8e49686033839ed8cfc84b0d5a6f47cb82c7af05a1c34846a67b59cb1304a6160d790f51c17c69e85019853
SSDEEP 24576:SaH1KrHMVHr3H5P/QDx1NNNRNNNB2EOyy8q5SBuLguALsaZP:FKYHrJg1NNNRNNNTON4
TLSH
T120555B81CE626905FE28D5BA0D8227A24474EAB9F6C705DC4513F41FA7B4C3B112B6FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.dll

Path C:\Users\Admin\AppData\Local\Temp\MyApp\log.dll
Size 100KB
SHA256 656e40d04a5365d21d149e9dceb38747b016608e5c95689114e0b34d3fecd477
MD5 5ba0bab412ebb69a653d7c269812af84
SHA1 b05df0b8cb5208159d20e699991e33f721adb2a8
SHA512 e3b14680fe903a9d7b4377c3e8e23c0d972d448810796b1f3272eca84026da5162bc1a5b5721e231cfb40d0e4b5fdf747bc6f0c261e187db4f98125002abb86b
SSDEEP 1536:cgM8666GnL2SIEGrhsMNOMUI76HDnp4qdYO:cgM8rLlljnpV
TLSH
T1E2A34A456B60EFB7D5418B3288F74325DA3EC1260B4219DF6C560A246F53BE94EB3F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3104-8-0x00000000031C0000-0x000000000330C000-memory.dmp

Download

memory/3104-9-0x0000000010000000-0x00000000100FC000-memory.dmp

Download

memory/3104-39-0x0000000000E80000-0x0000000000F66000-memory.dmp

Download

memory/3104-40-0x0000000074D30000-0x0000000074D47000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads