Overview

overview

9

Static

static

3

2026-11-02...er.exe

windows10-2004-x64

9

2026-11-02...er.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    117s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 22:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe
  • Size 7.5MB
  • Sample261102-11krtafx2m
  • SHA256 bc9bce396fddbba5e717249466519b61564a2fa4ceb6f88feabaccc14cc3484f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 11 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 1 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 10 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5832
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\new.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\2026-11-02_cff83ce921d2e1af3a8012cfb4736274_amadey_darkgate_dosia_elex_luca-stealer_njrat_quasar-rat_smoke-loader.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1793416490 " AI_EUIMSI=""
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:248
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6F7C432708D6EEE93A48E6A153540099 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:6136
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 01D078A16F61066CAE046FD1CD0BC327
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3240
    • C:\Windows\Installer\MSI64C2.tmp
      "C:\Windows\Installer\MSI64C2.tmp" /DontWait /HideWindow C:\Users\Public\Documents\ChessClub-x86_.exe
      2⤵
      • Executes dropped EXE
      PID:4224
    • C:\Windows\Installer\MSI64D3.tmp
      "C:\Windows\Installer\MSI64D3.tmp" /DontWait /HideWindow C:\Users\Public\Documents\ww.exe
      2⤵
      • Executes dropped EXE
      PID:4764
  • C:\Users\Public\Documents\ww.exe
    "C:\Users\Public\Documents\ww.exe"
    1⤵
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5356
  • C:\Users\Public\Documents\ChessClub-x86_.exe
    "C:\Users\Public\Documents\ChessClub-x86_.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3612
    • C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe
      "C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4200
      • C:\Windows\SYSTEM32\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dll",Ava
        3⤵
        • Badlisted process makes network request
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2592
    • C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe
      "C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2816

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e595c13.rbs
        • Path C:\Config.Msi\e595c13.rbs
        • Size 1.3MB
        • SHA256 c231345fc8bd47c3fe65e49958fc77989e364d413e8f57caa9ad4513023bc25e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        1
        • Path C:\ProgramData\5D5870BA0000212C\1
        • Size 255KB
        • SHA256 42bbeef58b251c14a310876bab32e828329b5dc8f684a53a18b03bb48701401d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AFILTER
        • Path C:\ProgramData\5D5870BA0000212C\AFILTER
        • Size 8KB
        • SHA256 1c354a36d77f6199f1b646e36f0e4eb0bf40d062f46ae8e462f6700753c4595f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GROUP
        • Path C:\ProgramData\5D5870BA0000212C\GROUP
        • Size 4B
        • SHA256 b1441fb610c44a4cf71233b0f3f75fb1f47193005b3ea33f6b6259b1448c918b
        • MD5 SHA1 SHA512
        Submit Download

        INSTALL_TIME
        • Path C:\ProgramData\5D5870BA0000212C\INSTALL_TIME
        • Size 38B
        • SHA256 38a7d4c680ca3c704c6c5d70c13b748f23896cfa684328d9487390c2ea86edf1
        • MD5 SHA1 SHA512
        Submit Download

        index.dat
        • Path C:\ProgramData\5D5870BA0000212C\Modules\x64\index.dat
        • Size 20B
        • SHA256 faac259b2022266c129d6892731e5e4f88481b9137fc2b3192dcc30dc70a84ff
        • MD5 SHA1 SHA512
        Submit Download

        index.dat.tmp
        • Path C:\ProgramData\5D5870BA0000212C\Modules\x64\index.dat.tmp
        • Size 20B
        • SHA256 462a12b50d42ac841aad10cafc72cf3a4c4af75af6fc0cb67bb9f8a0f098f843
        • MD5 SHA1 SHA512
        Submit Download

        REMARK
        • Path C:\ProgramData\5D5870BA0000212C\REMARK
        • Size 6B
        • SHA256 f3fb9e94f813be2cc4fb1d38777634a8dc079600027b5d19cd373ed21e327347
        • MD5 SHA1 SHA512
        Submit Download

        MSI5616.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI5616.tmp
        • Size 1.3MB
        • SHA256 9328928d724658d696bf252a42c4b9e525df41b956daeb9381bd1ac0ec302172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChessClub-x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bundle_run\ChessClub-x86.exe
        • Size 65KB
        • SHA256 78749719e61176fd23fcaff98caa402b1b1a5f585cf06e79fd6b5deaba6e1a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        safe.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bundle_run\safe.exe
        • Size 5.1MB
        • SHA256 fb857523fd4b3306a843aabb965c8d883abbd72f07517c9bf013357d8e5c024f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mina.dat
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dat
        • Size 17KB
        • SHA256 2cb50f33b0c15961962a4edc09191cd84a2a260278a1d6ed33df5050003a1247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mina.dll
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Vault\mina.dll
        • Size 1.2MB
        • SHA256 3a22cf20d03fb156f0142982bff7972d4e58efa1792985785abf0cf01373eb0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChessClub-x86_.exe
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\PublicDocumentsFolder\ChessClub-x86_.exe
        • Size 2.1MB
        • SHA256 66f6eb531489f0591312e090e7ab739e546a2dbfc440cd9555f3628be5fd097b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ww.exe
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\PublicDocumentsFolder\ww.exe
        • Size 120KB
        • SHA256 d4b6af5c98ef834760dcd493db306c3d827bf826c1794e6a2745cbceaee131af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        new.msi
        • Path C:\Users\Admin\AppData\Roaming\Your Company\new 1.0.0\install\4C6296F\new.msi
        • Size 3.6MB
        • SHA256 6fba53a764fe1d8c299966d7317fcdd157735ef16e0d91102234cc4027ce5880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI6201.tmp
        • Path C:\Windows\Installer\MSI6201.tmp
        • Size 1.1MB
        • SHA256 ab665924994a1438cd7cc2ca1bf1ab2b3b364fff1255f168d521bfdc1d8e988a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI64C2.tmp
        • Path C:\Windows\Installer\MSI64C2.tmp
        • Size 679KB
        • SHA256 e27478ea68721e954351cc46b5b38069971c8bf5b6406727d252d25316d4429e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2592-169-0x000002669D770000-0x000002669D81E000-memory.dmp
        Download

        memory/2592-172-0x000002669D770000-0x000002669D81E000-memory.dmp
        Download

        memory/2592-176-0x000002669D770000-0x000002669D81E000-memory.dmp
        Download

        memory/2592-177-0x000002669D770000-0x000002669D81E000-memory.dmp
        Download

        memory/2592-178-0x000002669D770000-0x000002669D81E000-memory.dmp
        Download

        memory/5356-129-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-134-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-151-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-118-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-124-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-120-0x000001DBFEF20000-0x000001DBFEFCE000-memory.dmp
        Download

        memory/5356-79-0x000001DBFCF20000-0x000001DBFCF25000-memory.dmp
        Download