5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
Size 1.7MB
Sample261011-27pvsaba23
SHA256 5e5b37c6b5dd642a23e7d08bb94092bf4e3c592e0756fa734803fddd6f7dd073
MD5 df05dcb7b675dcf11cc0293ad49d7ede
SHA1 c62b73d88c896831634af9afeab80b2885f347ce
SHA512 6b21d7e5ecde8334ddbc753ca99cf7474329ca7862846e784838b876b83edbe5f98dc9b2554d9adf9c75c5d72ec3bc90d7e633814c3d70a72091fe4b40ee48dc
SSDEEP 24576:WV8DpyztOVuIIvpaiO4mRXyKvlvx363zO/xTs3m+q0L+6kFoPV:k0psOkIAmJRpCS/xThP0q6kFO
TLSH
T183859D00B6E29074F9EB3331747CA73A5E357E51AB3489DB83841D985F342E199363AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4684	5052	2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
  C:\Users\Admin\AppData\Local\Temp\2026-10-09_df05dcb7b675dcf11cc0293ad49d7ede_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Torch\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=Torch --annotation=ver=69.2.0.1713 --initial-client-data=0x2a4,0x2a8,0x2ac,0x2a0,0x2b0,0x106e428,0x106e438,0x106e444
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Torch\User Data\Crashpad\settings.dat
Size 40B
SHA256 63e46d7b1a3b1090762d70b9a1ff095c8d1248f2da1dcab7a4dcd280a37ab611
MD5 6c119c0e9875b3bc11103704acfdede7
SHA1 dedb17e25daa5c8a3ef4104f8719ecce5915e63a
SHA512 21817ca27d4d6c4942868d080a22bd2ad508725ad7618aa4dd211e587da01b3eb81692ddc69f48310f90759bf26d2e1fbad6485d94198ef8d8224f37fbfa194c
MD5 SHA1 SHA512

Submit Download

memory/4684-1-0x0000000000F30000-0x00000000010F0000-memory.dmp

Download

memory/4684-7-0x0000000000F30000-0x00000000010F0000-memory.dmp

Download

memory/5052-0-0x0000000000F30000-0x00000000010F0000-memory.dmp

Download

memory/5052-5-0x0000000000F30000-0x00000000010F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads