Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 03:56
General
- Target 2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe
- Size 54.5MB
- Sample261027-ehhnvaat5x
- SHA256 7f0c5680e825e5febb846959a5b215769774a554c4714833a72365657d83de20
Malware Config
Signatures
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e6ce7e96483e064e283b7843d85e003a_darkgate_gcleaner_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GD0GF.tmp\Instagram Bot Pro Full Activated.tmp"C:\Users\Admin\AppData\Local\Temp\is-GD0GF.tmp\Instagram Bot Pro Full Activated.tmp" /SL5="$60192,55122170,1062912,C:\Users\Admin\AppData\Local\Temp\Instagram Bot Pro Full Activated.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\helper.exeC:\Users\Admin\AppData\Local\Temp\helper.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"C:\Users\Admin\AppData\Local\Realtek\Audio\HDA\RtkAudioService64.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
helper.exe
Instagram Bot Pro Full Activated.tmp
VclStylesInno.dll
memory/3764-9-0x0000000000820000-0x0000000000933000-memory.dmp
memory/3764-96-0x0000000000820000-0x0000000000933000-memory.dmp
memory/5256-33-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-36-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-34-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-50-0x0000000006000000-0x0000000006001000-memory.dmp
memory/5256-54-0x0000000006010000-0x0000000006011000-memory.dmp
memory/5256-58-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-92-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-91-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-90-0x00000000060D0000-0x00000000060D1000-memory.dmp
memory/5256-89-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-88-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-86-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-85-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-83-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-82-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-80-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-79-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-77-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-76-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-74-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-73-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-71-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-70-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-68-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-67-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-65-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-64-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-62-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-61-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-59-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-56-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-55-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-87-0x00000000060C0000-0x00000000060C1000-memory.dmp
memory/5256-84-0x00000000060B0000-0x00000000060B1000-memory.dmp
memory/5256-81-0x00000000060A0000-0x00000000060A1000-memory.dmp
memory/5256-78-0x0000000006090000-0x0000000006091000-memory.dmp
memory/5256-75-0x0000000006080000-0x0000000006081000-memory.dmp
memory/5256-72-0x0000000006070000-0x0000000006071000-memory.dmp
memory/5256-69-0x0000000006060000-0x0000000006061000-memory.dmp
memory/5256-66-0x0000000006050000-0x0000000006051000-memory.dmp
memory/5256-63-0x0000000006040000-0x0000000006041000-memory.dmp
memory/5256-60-0x0000000006030000-0x0000000006031000-memory.dmp
memory/5256-57-0x0000000006020000-0x0000000006021000-memory.dmp
memory/5256-52-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-51-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-49-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-46-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-45-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-43-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-42-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-40-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-39-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-47-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/5256-44-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
memory/5256-48-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-41-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
memory/5256-38-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
memory/5256-37-0x0000000005D50000-0x0000000005E90000-memory.dmp
memory/5256-35-0x0000000005FB0000-0x0000000005FB1000-memory.dmp
memory/5256-30-0x0000000005A30000-0x0000000005D4A000-memory.dmp
memory/5256-32-0x0000000005EA0000-0x0000000005EA1000-memory.dmp
memory/5256-97-0x0000000000D20000-0x00000000010BF000-memory.dmp