6c728b2980be15e4ba43ccb4b87b53b46105e31ad56faf7e941f77937a74f1cc

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/10/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 1.7MB
Sample261003-1ctd2sys9p
SHA256 6c728b2980be15e4ba43ccb4b87b53b46105e31ad56faf7e941f77937a74f1cc
MD5 270411dfa082f5d104f3fee57de7756e
SHA1 37aaf90ae2bd0f05407834778cd2c098fb770783
SHA512 d447a04e4467436306eead680105957efd6ae7d1c7396950a03df456e41753d7ec52b850d2905d3b26f2635b2e77b88b90b5ab65fab30aa2505f27e439996bde
SSDEEP 24576:f9pI85007b736UogCjWOqKVNcnw0ZVwoB0aKngL2jdshRTdG1YxITqvfPkbIcbjK:f9pX39KWOqY+nw0ZVw80arSj8RoTCCW
TLSH
T17085D0507756E232E56082F24D79AF96906DAD2C1F7206CFA3C41F3E88356D22E31E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1524	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
1524	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1524	2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_270411dfa082f5d104f3fee57de7756e_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1524-0-0x00000000014A0000-0x0000000001628000-memory.dmp

Download

memory/1524-1-0x0000000001290000-0x0000000001315000-memory.dmp

Download

memory/1524-7-0x0000000001290000-0x0000000001315000-memory.dmp

Download