Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 06:47
General
- Target 2026-10-16_cb7fe03ba07b52ee83bfdfcdbf0ac4ea_agent-tesla_amadey_darkgate_elex_gcleaner_luca-stealer_m.exe
- Size 36.7MB
- Sample261017-hkl1tsdf62
- SHA256 bd4a06d57f3383c03d3f63dd30ab318b2a0de90e5712e38f35d6748fa13ced56
Malware Config
Signatures
- Detects executables manipulated with Fody 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_cb7fe03ba07b52ee83bfdfcdbf0ac4ea_agent-tesla_amadey_darkgate_elex_gcleaner_luca-stealer_m.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_cb7fe03ba07b52ee83bfdfcdbf0ac4ea_agent-tesla_amadey_darkgate_elex_gcleaner_luca-stealer_m.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-0-0x0000000074C62000-0x0000000074C63000-memory.dmp
memory/2940-1-0x0000000000680000-0x0000000002B2E000-memory.dmp
memory/2940-2-0x0000000007B80000-0x000000000813A000-memory.dmp
memory/2940-3-0x0000000007660000-0x00000000076F2000-memory.dmp
memory/2940-4-0x0000000007600000-0x0000000007612000-memory.dmp
memory/2940-5-0x0000000007720000-0x000000000772A000-memory.dmp
memory/2940-7-0x00000000077E0000-0x000000000780A000-memory.dmp
memory/2940-8-0x0000000074C50000-0x000000007540C000-memory.dmp
memory/2940-6-0x0000000008B40000-0x0000000008D5E000-memory.dmp
memory/2940-9-0x000000000CE90000-0x000000000CF44000-memory.dmp
memory/2940-10-0x000000000CFC0000-0x000000000CFE2000-memory.dmp
memory/2940-11-0x000000000CFF0000-0x000000000D34B000-memory.dmp
memory/2940-13-0x000000000D3B0000-0x000000000D3EC000-memory.dmp
memory/2940-14-0x0000000074C50000-0x000000007540C000-memory.dmp
memory/2940-15-0x0000000074C62000-0x0000000074C63000-memory.dmp
memory/2940-16-0x0000000074C50000-0x000000007540C000-memory.dmp
memory/2940-17-0x0000000074C50000-0x000000007540C000-memory.dmp