Overview

overview

9

Static

static

3

2026-10-26...lu.exe

windows10-2004-x64

9

2026-10-26...lu.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 02:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_efd7a62ea80639ebc4199dbb6545ef6f_amadey_darkgate_elex_glassworm_hacktools_hijackloader_lu.exe
  • Size 54.3MB
  • Sample261027-dbt8maxy8n
  • SHA256 18c93f09f61b950ad8cb1e4e18bee58b49847dfc90c13de3f823ab5b9f593f54
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_efd7a62ea80639ebc4199dbb6545ef6f_amadey_darkgate_elex_glassworm_hacktools_hijackloader_lu.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_efd7a62ea80639ebc4199dbb6545ef6f_amadey_darkgate_elex_glassworm_hacktools_hijackloader_lu.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5456
    • C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.exe
      "C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.ex_
        C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.ex_
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3132
        • F:\ÖØ×°ÉÏÕó\ccfcdcffeb.ex_
          F:\ÖØ×°ÉÏÕó\ccfcdcffeb.ex_
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DRIVERDB.LOG
        • Path C:\DRIVERDB.LOG
        • Size 237B
        • SHA256 e035c33d78c3ef83e23a8a00c193f40c4127f6edc8bc9d2dc90e64fc071b955f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ccfcdcffeb.dat
        • Path C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.dat
        • Size 44.4MB
        • SHA256 4dc03d8857e413aec11fa99296c64f9f01f81aa33d9df12b706e0c6959754a47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ccfcdcffeb.ex_
        • Path C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.ex_
        • Size 21.2MB
        • SHA256 2fe7ff5195b94de0dd92e4f616e51ab6487d93a06e6e35fb12f895bc320b327d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ccfcdcffeb.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ccfcdcffeb.exe
        • Size 1.2MB
        • SHA256 ba9923de60e31b49b658d48489b84e6c6498381efbd4e714726a5c40516b4a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ÖØ×°ÉÏÕó.lnk
        • Path C:\Users\Admin\Desktop\ÖØ×°ÉÏÕó.lnk
        • Size 2KB
        • SHA256 f672f1053f98cba303478dff6065561c2665c59902215c483a017a881f0daae2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ÖØ×°ÉÏÕó.lnk
        • Path C:\Users\Admin\Desktop\ÖØ×°ÉÏÕó.lnk
        • Size 2KB
        • SHA256 5e751d828ef9e329fb57cbd0c1ae8bd484a14662c23217f7802ea2917366f150
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ÖØ×°ÉÏÕó.lnk
        • Path C:\Users\Admin\Desktop\ÖØ×°ÉÏÕó.lnk
        • Size 672B
        • SHA256 2ff409d236633d0b62e938f7b06868529633560884735f0b2bbbc39126a53704
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CN.ini
        • Path F:\ÖØ×°ÉÏÕó\996CN.ini
        • Size 1KB
        • SHA256 d95e28955de665c7286fd10ff57d767a16cb9b2f0f72fbe120d9d771788ee757
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CN38PK.ini
        • Path F:\ÖØ×°ÉÏÕó\996CN38PK.ini
        • Size 1KB
        • SHA256 276741713b60689e0699e4c5d07059d9128337d34fe8b2f3027b0bd3063d77d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CN8.ini
        • Path F:\ÖØ×°ÉÏÕó\996CN8.ini
        • Size 1KB
        • SHA256 18fd1098aae204bff11bd168e7e88f954181c27c0195bf425cab84c1c15e65c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CN8SSFF.ini
        • Path F:\ÖØ×°ÉÏÕó\996CN8SSFF.ini
        • Size 1KB
        • SHA256 92385d4eef7e73d932720bc824d095dea11dae08af7c0a283d8c5cdcd9d31f47
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CNTest.ini
        • Path F:\ÖØ×°ÉÏÕó\996CNTest.ini
        • Size 1KB
        • SHA256 f97002bd0db765dd5d099dbe21f7b83978eba0863c797a988b9e499f8023298b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        996CNEP.dat
        • Path F:\ÖØ×°ÉÏÕó\Data\996CNEP.dat
        • Size 500KB
        • SHA256 aa00df205dc74620c9f432e3bba00b88fb40e376f7c23b5d90f1856c0c5d9562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UserId.dat
        • Path F:\ÖØ×°ÉÏÕó\Data\UserId.dat
        • Size 9B
        • SHA256 38ae0c6bf24510f53f1d7c3e37ff6abada38a005f1dbd87aac07f029b3a91902
        • MD5 SHA1 SHA512
        Submit Download

        Game.exe
        • Path F:\ÖØ×°ÉÏÕó\Game.exe
        • Size 1.3MB
        • SHA256 047e8b717fb3203303da9407a6a95e45b9c9ce139027e46ee31edbcd6468c5fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameGuard.des
        • Path F:\ÖØ×°ÉÏÕó\GameGuard.des
        • Size 2.4MB
        • SHA256 306f039703f544e7e4a82730594b6c8cd763fc2e266fe47b4feac61db22863fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Login.ico
        • Path F:\ÖØ×°ÉÏÕó\Login.ico
        • Size 766B
        • SHA256 6c0a339149c404bc79fab09f364e1d2b6c6aa36593120e87bf0a7b6b729bbc02
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        NPGameDLL.dll
        • Path F:\ÖØ×°ÉÏÕó\NPGameDLL.dll
        • Size 4.2MB
        • SHA256 6d47d6fabb8988011d23d2198d7ad79d91357219fc9ab3430d9cbbf7be5bafc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dx9_33.dll
        • Path F:\ÖØ×°ÉÏÕó\d3dx9_33.dll
        • Size 3.3MB
        • SHA256 c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libeay32.dll
        • Path F:\ÖØ×°ÉÏÕó\libeay32.dll
        • Size 1.3MB
        • SHA256 5264a4a478383f501961f2bd9beb1f77a43a487b76090561bba2cbfe951e5305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssleay32.dll
        • Path F:\ÖØ×°ÉÏÕó\ssleay32.dll
        • Size 330KB
        • SHA256 0a4031ab00664cc5e202c8731798800f0475ef76800122cebd71d249655d725f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3132-38-0x0000000005580000-0x00000000055C6000-memory.dmp
        Download

        memory/3132-36-0x0000000005010000-0x000000000505C000-memory.dmp
        Download

        memory/3132-43-0x000000000C430000-0x000000000C529000-memory.dmp
        Download

        memory/3132-46-0x000000000CD70000-0x000000000CD84000-memory.dmp
        Download

        memory/3132-41-0x000000000B380000-0x000000000B9DC000-memory.dmp
        Download

        memory/3132-37-0x0000000005060000-0x0000000005233000-memory.dmp
        Download

        memory/3132-40-0x0000000008DF0000-0x0000000008FCB000-memory.dmp
        Download

        memory/3132-34-0x0000000000400000-0x000000000194D000-memory.dmp
        Download

        memory/3132-39-0x0000000005660000-0x0000000005D1E000-memory.dmp
        Download

        memory/3132-45-0x000000000C530000-0x000000000C54D000-memory.dmp
        Download

        memory/3132-35-0x0000000003900000-0x0000000003929000-memory.dmp
        Download

        memory/5456-0-0x0000000000400000-0x0000000003A99000-memory.dmp
        Download

        memory/5456-22-0x0000000006970000-0x0000000006B78000-memory.dmp
        Download

        memory/5456-14-0x0000000000400000-0x0000000003A99000-memory.dmp
        Download

        memory/5456-1-0x0000000000400000-0x0000000003A99000-memory.dmp
        Download

        memory/5456-4-0x0000000077740000-0x0000000077741000-memory.dmp
        Download

        memory/5456-5-0x0000000006970000-0x0000000006B78000-memory.dmp
        Download

        memory/5456-3-0x0000000075D40000-0x0000000075D41000-memory.dmp
        Download

        memory/5884-140-0x0000000005270000-0x000000000527C000-memory.dmp
        Download

        memory/5884-152-0x00000000098B0000-0x00000000098BE000-memory.dmp
        Download

        memory/5884-144-0x0000000005660000-0x0000000005D1E000-memory.dmp
        Download

        memory/5884-135-0x0000000000400000-0x000000000194D000-memory.dmp
        Download

        memory/5884-146-0x0000000008270000-0x0000000008484000-memory.dmp
        Download

        memory/5884-154-0x000000000C110000-0x000000000C2B3000-memory.dmp
        Download

        memory/5884-148-0x000000000B3E0000-0x000000000BA3C000-memory.dmp
        Download

        memory/5884-147-0x0000000008DF0000-0x0000000008FCB000-memory.dmp
        Download

        memory/5884-153-0x000000000B100000-0x000000000B114000-memory.dmp
        Download

        memory/5884-136-0x0000000004A40000-0x0000000004A69000-memory.dmp
        Download

        memory/5884-151-0x0000000009830000-0x00000000098A7000-memory.dmp
        Download

        memory/5884-150-0x0000000009810000-0x000000000982D000-memory.dmp
        Download

        memory/5884-149-0x0000000009700000-0x00000000097C6000-memory.dmp
        Download

        memory/5884-145-0x0000000007D50000-0x0000000008262000-memory.dmp
        Download

        memory/5884-142-0x0000000005480000-0x000000000556F000-memory.dmp
        Download

        memory/5884-141-0x0000000005280000-0x000000000546F000-memory.dmp
        Download

        memory/5884-143-0x0000000005580000-0x00000000055C6000-memory.dmp
        Download

        memory/5884-137-0x0000000005010000-0x000000000505C000-memory.dmp
        Download

        memory/5884-139-0x0000000005240000-0x000000000526B000-memory.dmp
        Download

        memory/5884-138-0x0000000005060000-0x0000000005233000-memory.dmp
        Download