Overview

overview

8

Static

static

3

2026-11-09...te.exe

windows10-2004-x64

8

2026-11-09...te.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/11/2026, 17:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-09_65e6709f4ad5202c128c613d8d37c894_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
  • Size 1.7MB
  • Sample261110-v4x9eshd24
  • SHA256 df05aed8e0bf836a371ca485fdfe947f708fdba13b170631c3db9c2d251fc4fd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-09_65e6709f4ad5202c128c613d8d37c894_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-09_65e6709f4ad5202c128c613d8d37c894_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
      "adobearm32.exe "
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        3⤵
          PID:2128
        • C:\ProgramData\Adobe\ARM\S\25176\AdobeARMHelper.exe
          "C:\ProgramData\Adobe\ARM\S\25176\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\25176" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\25176" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
            4⤵
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4724
      • C:\Windows\SysWOW64\eventviewer.exe
        "C:\Windows\system32\eventviewer.exe"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3516
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 1604
          3⤵
          • Program crash
          PID:5792
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 1900
        2⤵
        • Program crash
        PID:1528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3516 -ip 3516
      1⤵
        PID:2672
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2936 -ip 2936
        1⤵
          PID:1944

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 82B
              • SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\25176\AdobeARM.msi
              • Size 1.0MB
              • SHA256 561af66f90a5104753bca640f6b1d2b2e7cdea64fc8f11ef2cd62b3c9ce36743
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\25176\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
              • Size 808B
              • SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 e692b8539b252cd40bbe7f0015eaaf466298c96f8883acebbfa24bb99c333b0d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Size 240KB
              • SHA256 435d4bb0093ff5ecce3672a434b0bd3dafa54ac4acc4aa70752bf27d504713ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 1ca605429923cc2383cf1a05e07b3dc87f6b67fbe51e6a0493e566aafec103d1
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 e8d32c63f3985d93111eb08fc854b6b41d87525b54f55dfc4416e2ca5bf31bbd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 9fbf78682aafa571331eb73dd361eed2a906eef684a92a28e29be4b610e48b20
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 701B
              • SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
              • Size 192B
              • SHA256 0f1686b9281b964c57b2b9394c3358fc6e2a8ca1d2353a027d5185f8e2382e96
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 04332de77505f02610f9a7d04b34ecb207227b957cca47d1e2661bd32f1c98dd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Size 246B
              • SHA256 d5bd56801be081a5eec2ddf0d7ec96b60d9b58adea8e7860328f24e26cf6fa7c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 677f3a877c7f64e494bd96ca270a9c67dc38156d68a56e666cab838852de6619
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 fcf0870512e3272d03ab73a7fb41d731145006d29aa296740505cb795956e39f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 f0a18f3760937b61dc1b2198f61cde2cce421098c178b8552537ae259401532e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 192B
              • SHA256 6a81d8ffa1f8a91abc2b259fcda995fcdc3ece96e128322f74c1878f99c686b6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 334B
              • SHA256 f3f371dc073c640c23e0cdfeaf55081aae180a758b69aad32dcf3f0e9d0dff36
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp202E.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp202E.tmp
              • Size 5KB
              • SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp20FA.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp20FA.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Tmp234.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp234.tmp
              • Size 5KB
              • SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp2744.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp2744.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp5701.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp5701.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              adobearm32.exe
              • Path C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
              • Size 1.5MB
              • SHA256 3fb224a6269885a6ea317388e27f854fe44bdf2652b405f321d00b358a839d81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redevlist.dat
              • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
              • Size 12KB
              • SHA256 d1b6b98bcb445eabeba19eb50c41cb678896d0c08d1785e6d277cf44e872141f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redevlist.dat
              • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
              • Size 209KB
              • SHA256 7b29d3bbb9fee6fd4d4a36efb24f0bac7e7f986e8c56bc9b8a93268cb91e0c4d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eventviewer.exe
              • Path C:\Windows\SysWOW64\eventviewer.exe
              • Size 88KB
              • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 472B
              • SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 594B
              • SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 724B
              • SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Windows\Temp\ArmUI.ini
              • Size 234KB
              • SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download