Overview

overview

9

Static

static

3

2026-11-02...er.exe

windows10-2004-x64

9

2026-11-02...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 22:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe
  • Size 7.5MB
  • Sample261102-11krtafx2m
  • SHA256 bc9bce396fddbba5e717249466519b61564a2fa4ceb6f88feabaccc14cc3484f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\new.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1793416526 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4772
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 2F5C3BE6188BB309E40C3ABA6C720CA8 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2532
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0A606CD61A7A47D8A007622EB0131A31
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3780
    • C:\Windows\Installer\MSIC779.tmp
      "C:\Windows\Installer\MSIC779.tmp" /DontWait /HideWindow C:\Users\Public\Documents\ChessClub-x86_.exe
      2⤵
      • Executes dropped EXE
      PID:456
    • C:\Windows\Installer\MSIC77A.tmp
      "C:\Windows\Installer\MSIC77A.tmp" /DontWait /HideWindow C:\Users\Public\Documents\ww.exe
      2⤵
      • Executes dropped EXE
      PID:2784
  • C:\Users\Public\Documents\ww.exe
    "C:\Users\Public\Documents\ww.exe"
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:212
  • C:\Users\Public\Documents\ChessClub-x86_.exe
    "C:\Users\Public\Documents\ChessClub-x86_.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe
      "C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dll",Ava
        3⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3260
    • C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe
      "C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5096

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e58c504.rbs
        • Path C:\Config.Msi\e58c504.rbs
        • Size 1.3MB
        • SHA256 b38f5a2d277661ccd8e52020ac65d64e6ee9a05a8bad157a467b6e125fffad1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1
        • Path C:\ProgramData\5D5870BA0000212C\1
        • Size 255KB
        • SHA256 42bbeef58b251c14a310876bab32e828329b5dc8f684a53a18b03bb48701401d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AFILTER
        • Path C:\ProgramData\5D5870BA0000212C\AFILTER
        • Size 8KB
        • SHA256 1c354a36d77f6199f1b646e36f0e4eb0bf40d062f46ae8e462f6700753c4595f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GROUP
        • Path C:\ProgramData\5D5870BA0000212C\GROUP
        • Size 4B
        • SHA256 b1441fb610c44a4cf71233b0f3f75fb1f47193005b3ea33f6b6259b1448c918b
        • MD5 SHA1 SHA512
        Submit Download

        INSTALL_TIME
        • Path C:\ProgramData\5D5870BA0000212C\INSTALL_TIME
        • Size 38B
        • SHA256 b4a2a9afe440a06b78c3d1552f9df9664f7c14cc477c510a49fe40236fe7a98d
        • MD5 SHA1 SHA512
        Submit Download

        index.dat
        • Path C:\ProgramData\5D5870BA0000212C\Modules\x64\index.dat
        • Size 20B
        • SHA256 8e45be5f53b5e32b1db9490a4023abb281a11b31d08d873fade4880b35d28ce4
        • MD5 SHA1 SHA512
        Submit Download

        index.dat.tmp
        • Path C:\ProgramData\5D5870BA0000212C\Modules\x64\index.dat.tmp
        • Size 20B
        • SHA256 71885a48532e68db6f7f2bfa31040f02a684d13aec4cf00aa27ed3efa1930973
        • MD5 SHA1 SHA512
        Submit Download

        REMARK
        • Path C:\ProgramData\5D5870BA0000212C\REMARK
        • Size 6B
        • SHA256 f3fb9e94f813be2cc4fb1d38777634a8dc079600027b5d19cd373ed21e327347
        • MD5 SHA1 SHA512
        Submit Download

        MSIC2B0.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIC2B0.tmp
        • Size 1.3MB
        • SHA256 9328928d724658d696bf252a42c4b9e525df41b956daeb9381bd1ac0ec302172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChessClub-x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe
        • Size 65KB
        • SHA256 78749719e61176fd23fcaff98caa402b1b1a5f585cf06e79fd6b5deaba6e1a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        safe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe
        • Size 5.1MB
        • SHA256 fb857523fd4b3306a843aabb965c8d883abbd72f07517c9bf013357d8e5c024f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mina.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dat
        • Size 17KB
        • SHA256 2cb50f33b0c15961962a4edc09191cd84a2a260278a1d6ed33df5050003a1247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mina.dll
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dll
        • Size 1.2MB
        • SHA256 3a22cf20d03fb156f0142982bff7972d4e58efa1792985785abf0cf01373eb0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChessClub-x86_.exe
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\PublicDocumentsFolder\ChessClub-x86_.exe
        • Size 2.1MB
        • SHA256 66f6eb531489f0591312e090e7ab739e546a2dbfc440cd9555f3628be5fd097b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ww.exe
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\PublicDocumentsFolder\ww.exe
        • Size 120KB
        • SHA256 d4b6af5c98ef834760dcd493db306c3d827bf826c1794e6a2745cbceaee131af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        new.msi
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\new.msi
        • Size 3.6MB
        • SHA256 6fba53a764fe1d8c299966d7317fcdd157735ef16e0d91102234cc4027ce5880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIC60F.tmp
        • Path C:\Windows\Installer\MSIC60F.tmp
        • Size 1.1MB
        • SHA256 ab665924994a1438cd7cc2ca1bf1ab2b3b364fff1255f168d521bfdc1d8e988a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSIC77A.tmp
        • Path C:\Windows\Installer\MSIC77A.tmp
        • Size 679KB
        • SHA256 e27478ea68721e954351cc46b5b38069971c8bf5b6406727d252d25316d4429e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/212-138-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-137-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-128-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-125-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-158-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-163-0x000002752D040000-0x000002752D0EE000-memory.dmp
        Download

        memory/212-80-0x000002752B020000-0x000002752B025000-memory.dmp
        Download

        memory/3260-155-0x000002430CF00000-0x000002430CFAE000-memory.dmp
        Download

        memory/3260-157-0x000002430CF00000-0x000002430CFAE000-memory.dmp
        Download

        memory/3260-167-0x000002430CF00000-0x000002430CFAE000-memory.dmp
        Download

        memory/3260-168-0x000002430CF00000-0x000002430CFAE000-memory.dmp
        Download

        memory/3260-169-0x000002430CF00000-0x000002430CFAE000-memory.dmp
        Download