Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 23:27
General
- Target 2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe
- Size 1.7MB
- Sample261011-3fkmesbb99
- SHA256 f243168a14b785bca6fa9a4a2bcd27e41f1eee35638f64ff68e1e046fb19b831
Score
7/10
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exeC:\Users\Admin\AppData\Local\Temp\2026-10-09_797f9830918933f19b83b7a2d6063960_amadey_darkgate_elex_luca-stealer_njrat_ramnit_smoke-loader.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Torch\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=Torch --annotation=ver=69.2.0.1713 --initial-client-data=0x264,0x268,0x26c,0x25c,0x270,0x32e428,0x32e438,0x32e4442⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
memory/2656-4-0x00000000001F0000-0x00000000003B0000-memory.dmp
memory/2656-7-0x00000000001F0000-0x00000000003B0000-memory.dmp
memory/4916-0-0x00000000001F0000-0x00000000003B0000-memory.dmp
memory/4916-5-0x00000000001F0000-0x00000000003B0000-memory.dmp