Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/11/2026, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe
- Size 19.2MB
- Sample261113-dkngfae15w
- SHA256 30fbdd58406790adafb78c9b310887a073d0ab91addd13fcf1545dd1f8e607b9
- MD5 52859eb247542548ad447be12091f7b8
- SHA1 7ec7b296da71025d1596d966f14eaddaa9ba0169
- SHA512 3e7e7f3322c09d970faf5c720aa74681e05fba42334a569b7afea4952cc8e5a6f46e531196c0054a3cf3cc5ff12d77d72c1627b99f50be71aa7c73d77eff59a3
- SSDEEP 393216:YYwnBgDdiBfEScEW1oY4smJ62mWC08ohSw0:YqiBTcE8eEaZ
- TLSH T17D179D11E7D34171FAB31670997AA27A853FBE700971CC4FA28C9E4D6B739C1892172B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 704 files.dat 3020 setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5944 cmd.exe 2388 cmd.exe 3800 cmd.exe 4220 cmd.exe 2716 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WMIC.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain setup.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language files.dat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz OUTLOOK.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString OUTLOOK.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily OUTLOOK.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU OUTLOOK.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001" OUTLOOK.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" OUTLOOK.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" OUTLOOK.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1220 OUTLOOK.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1588 WMIC.exe 1588 WMIC.exe 1588 WMIC.exe 1588 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe 4108 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeIncreaseQuotaPrivilege 1588 WMIC.exe Token: SeSecurityPrivilege 1588 WMIC.exe Token: SeTakeOwnershipPrivilege 1588 WMIC.exe Token: SeLoadDriverPrivilege 1588 WMIC.exe Token: SeSystemProfilePrivilege 1588 WMIC.exe Token: SeSystemtimePrivilege 1588 WMIC.exe Token: SeProfSingleProcessPrivilege 1588 WMIC.exe Token: SeIncBasePriorityPrivilege 1588 WMIC.exe Token: SeCreatePagefilePrivilege 1588 WMIC.exe Token: SeBackupPrivilege 1588 WMIC.exe Token: SeRestorePrivilege 1588 WMIC.exe Token: SeShutdownPrivilege 1588 WMIC.exe Token: SeDebugPrivilege 1588 WMIC.exe Token: SeSystemEnvironmentPrivilege 1588 WMIC.exe Token: SeRemoteShutdownPrivilege 1588 WMIC.exe Token: SeUndockPrivilege 1588 WMIC.exe Token: SeManageVolumePrivilege 1588 WMIC.exe Token: 33 1588 WMIC.exe Token: 34 1588 WMIC.exe Token: 35 1588 WMIC.exe Token: 36 1588 WMIC.exe Token: SeIncreaseQuotaPrivilege 4108 WMIC.exe Token: SeSecurityPrivilege 4108 WMIC.exe Token: SeTakeOwnershipPrivilege 4108 WMIC.exe Token: SeLoadDriverPrivilege 4108 WMIC.exe Token: SeSystemProfilePrivilege 4108 WMIC.exe Token: SeSystemtimePrivilege 4108 WMIC.exe Token: SeProfSingleProcessPrivilege 4108 WMIC.exe Token: SeIncBasePriorityPrivilege 4108 WMIC.exe Token: SeCreatePagefilePrivilege 4108 WMIC.exe Token: SeBackupPrivilege 4108 WMIC.exe Token: SeRestorePrivilege 4108 WMIC.exe Token: SeShutdownPrivilege 4108 WMIC.exe Token: SeDebugPrivilege 4108 WMIC.exe Token: SeSystemEnvironmentPrivilege 4108 WMIC.exe Token: SeRemoteShutdownPrivilege 4108 WMIC.exe Token: SeUndockPrivilege 4108 WMIC.exe Token: SeManageVolumePrivilege 4108 WMIC.exe Token: 33 4108 WMIC.exe Token: 34 4108 WMIC.exe Token: 35 4108 WMIC.exe Token: 36 4108 WMIC.exe Token: SeIncreaseQuotaPrivilege 4108 WMIC.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE - Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 3020 setup.exe 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE 1220 OUTLOOK.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3428 wrote to memory of 3800 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 90 PID 3800 wrote to memory of 1588 3800 cmd.exe 92 PID 3428 wrote to memory of 4220 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 94 PID 3428 wrote to memory of 2716 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 96 PID 2716 wrote to memory of 4108 2716 cmd.exe 98 PID 3428 wrote to memory of 5944 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 99 PID 5944 wrote to memory of 704 5944 cmd.exe 101 PID 3428 wrote to memory of 2388 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 102 PID 3428 wrote to memory of 1220 3428 2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe 104 PID 2388 wrote to memory of 3020 2388 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\2026-11-12_52859eb247542548ad447be12091f7b8_amadey_darkgate_elex_glassworm_luca-stealer_njrat_remcos.exe"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c copy C:\Windows\system32\Tasks\OInstall "C:\Windows\Temp\OInstall.tmp" /Y2⤵
- Executes a command shell one-liner
PID:4220
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4108
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\files\files.datfiles.dat -y -pkmsauto3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:704
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\Sysnative\cmd.exe" /D /c C:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\files\setup.exeC:\Users\Admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xml3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
-
C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1220
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\OFFICE~1\v32_16.0.20527.20196.cab
- Size 11KB
- SHA256 be33744160a36a61807164369edb8313dc37d118cddef31f5675805e73466f71
- MD5 237d23f739c1960acdcb8c2e24cb1a58
- SHA1 b93cac220e411b55758da36ad835587b4af7239b
- SHA512 c2d8b1dea56ba8119907f01906480017ce368102c15dd0328a01f878011742ed9d74d79e820329916b69b24b8a24d3b43cf98e209f26e09845a6b94cddec21dd
- SSDEEP 192:y3eHiHqca8LxyQxh4FYqwNOmTTnJ0k2K13X01k9z3A0+WpU8:y3THqcaGAEh4FYVNOG2QR9zYWZ
- TLSH T163424BE64E2C9082D99ABC6092D9EE837C7C93CB0D44A45616E6F6842D837DAD76407C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\OfficeC2RF16DA6CC-A49C-470A-9C9E-7E09320B51E0\VersionDescriptor.xml
- Size 25KB
- SHA256 422e8befc241dc08631f00961cded6ebfe2caff2930c7dd02f34b035b177f98a
- MD5 ff89557a740d639ba49bca9d7be4af1d
- SHA1 ac89fc6c2eb8120cbe1c03c3fa47bb3dc9dc1926
- SHA512 49d7774190aa2ac45ac3636cf076586a570e8e94f5590f3467db7df23d2d57c01a0e96b615b292a43737d435845e0a60485d448d09dc8aa1654e20a328f09018
- SSDEEP 96:aABjDt5O8qwEB+yY/VqJFWRGB/Aylkmo9g9s5UmiVSItzt3XNIR4ja9a9DMeJVnU:H/rZ73
- TLSH T1A2C2456BB8D03D1D413477A7E96336E2EF62826396050458F10D734B3FB285DB3AB629
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\Configure.xml
- Size 502B
- SHA256 5dd6a2cbaf3fe54e623ae8ca79cf3b4bd15871c2ea68a3ce669a854238fd1223
- MD5 057b592b8166e85054f04a76633be4b9
- SHA1 bccbf3660857aacd72fe7925800804ee10f728c2
- SHA512 41bd363e55d4e1532d961b39fa1771a6537aed57dca95a3befe5d006bf79d0ec1d1ead376f721b9c8a49fa0c86a457583690f5158af31fe4aa6735aafd4969c3
- TLSH T13AF08290EA9C2D856731513991CA6B85FD6622634D212D08B18FA64B8BFB838334701F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\files.dat
- Size 707KB
- SHA256 7a1c82e264258470d14ca345ea1a9b6fc34fa19b393a92077a01be5f1ad08f47
- MD5 55d21b2c272a5d6b9f54fa9ed82bf9eb
- SHA1 32464cba823cd9b7e94e4fa1a32a8f2344b0f33b
- SHA512 1b68d0c61367717529be4a3aa347bb69d3e21de7a89b10e8b0aa54d40af988cc0cc8e63298ba595a93c3372aca3770ace1eee2780a59238d0948499dbb4be725
- SSDEEP 12288:3XikbkgaISKVHNJhk2X4hGeHJ3ZWpZaw+ovKE88agUZ+Z00KvxHbeQiHhYfNx9nj:3Xi6kgaINVHLhk2XeH2xPHXUZf0IeQs8
- TLSH T16AF402123AF1C13BE1420532CEC9ABF6A1F2E2580F21885773D51B2D3EBD985D635B69
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\files\setup.exe
- Size 5.4MB
- SHA256 1542ed413c1d21ca7b5cde39ce4e0d4ee592de26a25a9868ece77b875a16639e
- MD5 64b22215cca284010e9bf96eb5ae2f02
- SHA1 65ca0d5558f8461efe3cb70bda1949bb78a2a811
- SHA512 9951f9e4817cf1fe7c53cc92acd7ac4d0d7621109ab9b204136523d21514a7964d2ecf89f13e3e6d881654e5e1b44606e70ab020125d2be2e2989dbecbb9fd39
- SSDEEP 98304:zGrSU2RFMu6kpUDAdbsWo93oTBVh/y3AXGqtw+/ok8LXKpHcYBwY2h/wI:zcSFpUD6o93iBVhaQXGqtw+gxCHcEWF
- TLSH T127464921E7D74736FFB617706D79A659446DBDF10AF1CC0F62840E4D1AB0A82A920B2F
- MD5 SHA1 SHA512 SSDEEP TLSH