5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
Size 1.7MB
Sample261011-27pvsaba23
SHA256 5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073
MD5 df05dcb7b675dcf11cc0293ad49d7ede
SHA1 c62b73d88c896831634af9afeab80b2885f347ce
SHA512 6b21d7e5ecde8334ddbc753ca99cf7474329ca7862846e784838b876b83edbe5f98dc9b2554d9adf9c75c5d72ec3bc90d7e633814c3d70a72091fe4b40ee48dc
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoPV:k0psOkIAmJRpCS/xThP0q6kFO
TLSH
T183859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4592	1496	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Torch\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=Torch --annotation=ver=69.2.0.1713 --initial-client-data=0x264,0x268,0x26c,0x25c,0x270,0x1ce428,0x1ce438,0x1ce444
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Torch\User Data\Crashpad\settings.dat
Size 40B
SHA256 f0d0debf821cd200da528dda8646451179a1c32b108e03f26c2ccca1db31d49b
MD5 f3a98c7bb0737abe49f7b78686898f71
SHA1 56231558e727338a15182fbb09ead9a3c89c9ff2
SHA512 81f640209025ff5e6955f118e3833472a305eafa63024c92bf63097f286747dc6cad73dd2f66bf5a9c024168b3e6542320a7178d3ea7a202cb6cac6521138fb6
MD5 SHA1 SHA512

Submit Download

memory/1496-0-0x0000000000090000-0x0000000000250000-memory.dmp

Download

memory/1496-5-0x0000000000090000-0x0000000000250000-memory.dmp

Download

memory/4592-1-0x0000000000090000-0x0000000000250000-memory.dmp

Download

memory/4592-7-0x0000000000090000-0x0000000000250000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads