Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 03:56
General
- Target 2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe
- Size 54.5MB
- Sample261027-ehhnvaat5x
- SHA256 7f0c5680e825e5febb846959a5b215769774a554c4714833a72365657d83de20
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PQE5A.tmp\Instagram Bot Pro Full Activated.tmp"C:\Users\Admin\AppData\Local\Temp\is-PQE5A.tmp\Instagram Bot Pro Full Activated.tmp" /SL5="$C010E,55122170,1062912,C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\helper.exeC:\Users\Admin\AppData\Local\Temp\helper.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
helper.exe
VclStylesInno.dll
Instagram Bot Pro Full Activated.tmp
memory/3488-9-0x0000000000260000-0x0000000000373000-memory.dmp
memory/3488-97-0x0000000000260000-0x0000000000373000-memory.dmp
memory/4216-29-0x00000000054F0000-0x000000000580A000-memory.dmp
memory/4216-47-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-50-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-54-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-53-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-52-0x0000000005AD0000-0x0000000005AD1000-memory.dmp
memory/4216-51-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-49-0x0000000005AC0000-0x0000000005AC1000-memory.dmp
memory/4216-48-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-46-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
memory/4216-45-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-44-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-43-0x0000000005AA0000-0x0000000005AA1000-memory.dmp
memory/4216-42-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-39-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-40-0x0000000005A90000-0x0000000005A91000-memory.dmp
memory/4216-38-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-37-0x0000000005A80000-0x0000000005A81000-memory.dmp
memory/4216-36-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-35-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-34-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/4216-41-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-33-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-32-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-31-0x0000000005960000-0x0000000005961000-memory.dmp
memory/4216-64-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-90-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-93-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-92-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-91-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/4216-89-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-88-0x0000000005B80000-0x0000000005B81000-memory.dmp
memory/4216-85-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-84-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-83-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/4216-82-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-81-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-80-0x0000000005B60000-0x0000000005B61000-memory.dmp
memory/4216-79-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-78-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-77-0x0000000005B50000-0x0000000005B51000-memory.dmp
memory/4216-76-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-75-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-74-0x0000000005B40000-0x0000000005B41000-memory.dmp
memory/4216-73-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-72-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-71-0x0000000005B30000-0x0000000005B31000-memory.dmp
memory/4216-70-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-69-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-68-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/4216-67-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-66-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-63-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-61-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-60-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-59-0x0000000005AF0000-0x0000000005AF1000-memory.dmp
memory/4216-57-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-56-0x0000000005810000-0x0000000005950000-memory.dmp
memory/4216-55-0x0000000005AE0000-0x0000000005AE1000-memory.dmp
memory/4216-65-0x0000000005B10000-0x0000000005B11000-memory.dmp
memory/4216-62-0x0000000005B00000-0x0000000005B01000-memory.dmp
memory/4216-98-0x0000000000A40000-0x0000000000DDF000-memory.dmp