Overview

overview

8

Static

static

3

2026-11-12...te.exe

windows10-2004-x64

8

2026-11-12...te.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    131s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_39336a5c34ddb007ca5ef5af2a111df5_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
  • Size 1.7MB
  • Sample261113-ftv9ragv2q
  • SHA256 896ef7232c8043f587d17473da64d5a169eaa98c2fe2b467caeb646b63b78f9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_39336a5c34ddb007ca5ef5af2a111df5_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_39336a5c34ddb007ca5ef5af2a111df5_amadey_darkgate_elex_emotet_hijackloader_icedid_luca-ste.exe"
    1⤵
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
      "adobearm32.exe "
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5204
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        3⤵
          PID:3660
        • C:\ProgramData\Adobe\ARM\S\5158\AdobeARMHelper.exe
          "C:\ProgramData\Adobe\ARM\S\5158\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\5158" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1868
          • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
            "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\5158" /MODE:3 /UpdateSelection:1 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
            4⤵
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4432
      • C:\Windows\SysWOW64\eventviewer.exe
        "C:\Windows\system32\eventviewer.exe"
        2⤵
        • Executes dropped EXE
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3748
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 1792
          3⤵
          • Program crash
          PID:5600
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4292 -s 1476
        2⤵
        • Program crash
        PID:5128
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4292 -ip 4292
      1⤵
        PID:3524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3748 -ip 3748
        1⤵
          PID:5640

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ArmReport.ini
              • Path C:\ProgramData\Adobe\ARM\ArmReport.ini
              • Size 82B
              • SHA256 5a1e0a0216dd3893a738efdfc9c1bc5445e68d3939840578341f6cd08b14d815
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.msi
              • Path C:\ProgramData\Adobe\ARM\S\5158\AdobeARM.msi
              • Size 1.0MB
              • SHA256 561af66f90a5104753bca640f6b1d2b2e7cdea64fc8f11ef2cd62b3c9ce36743
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AdobeARMHelper.exe
              • Path C:\ProgramData\Adobe\ARM\S\5158\AdobeARMHelper.exe
              • Size 413KB
              • SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              RdrManifest2.msi
              • Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
              • Size 18KB
              • SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
              • Size 836B
              • SHA256 10ce6a561968b29ac9d759ac8dbf69e4c2b2a775006fefbd7768f7515457a502
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 471B
              • SHA256 5542da9158101b864683719364c860fae2b9087a72c2543385e427c15e61abf3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Size 241KB
              • SHA256 14abefb0f4dcf64a8b3604b0f2073248bfa9aaf22856cd25a1b8e7548802349f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 727B
              • SHA256 efd3e4172933af1f1758906302cc6ae718c9ea397a4e2f9e451e709c2983a754
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 727B
              • SHA256 d29eef0cb116a3639ae526077932c3035850efc9f065818774f896ebf0e5890a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 727B
              • SHA256 1e416c31c090fe83a8eae7588a7301d1d9b7f8d1a9878ec5aeb23bf2028a2bbf
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 701B
              • SHA256 91b79e7eb875f3a0eecf676e8c38b189823f56078c808bce49bdc3de74693a54
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              103621DE9CD5414CC2538780B4B75751
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
              • Size 192B
              • SHA256 a3746d9b988612a2247a1a504daad097e317eac0d42d21342801332c96b5199a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              • Size 400B
              • SHA256 89910ade5a49352422899ef1cd0e2e00f3ec624f9142462bb1f80c880552ffa7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8CE4A33FEB8CD35F8F6C8D2BE260E617
              • Size 246B
              • SHA256 0514f5e23b28d103b276196640d2668ae3670a5b941206bdee2f675156ed778b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
              • Size 404B
              • SHA256 8ec1cdcb8ba931f9266fb35b03bcadce29d73f30d20f205bfb4ffa37d1a7becc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
              • Size 404B
              • SHA256 33d38f8c5732b0cece8f6ca508a28e28b947954e2087e74955325a7ca8873213
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              • Size 412B
              • SHA256 d1de0a858c0be570b537b2019f6207b061182eb1d83b4e81ce95f05742f052b2
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              F15827BEC5BABE89C21DCDAE77464BF1
              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
              • Size 192B
              • SHA256 03d5b28709e23b6a59ad81d1035f17e2ef712e700c5566c34e8e1ef087f57a0f
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              AdobeARM.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
              • Size 333B
              • SHA256 ef857657fff8ae6c762f5ecdc60ac5eb80057acf877f87d46333969d6de743a4
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
              • Size 251KB
              • SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp335C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp335C.tmp
              • Size 5KB
              • SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Tmp3CE.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp3CE.tmp
              • Size 5KB
              • SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpDEEC.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpDEEC.tmp
              • Size 5KB
              • SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpFCF6.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpFCF6.tmp
              • Size 5KB
              • SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TmpFDA3.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TmpFDA3.tmp
              • Size 3KB
              • SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              adobearm32.exe
              • Path C:\Users\Admin\AppData\Local\Temp\adobearm32.exe
              • Size 1.5MB
              • SHA256 3fb224a6269885a6ea317388e27f854fe44bdf2652b405f321d00b358a839d81
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              redevlist.dat
              • Path C:\Users\Admin\AppData\Local\Temp\redevlist.dat
              • Size 209KB
              • SHA256 1e3cb7799c5681eef6ec3485147981c1c15c53c4bba00191d2023434a6e2efbb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              eventviewer.exe
              • Path C:\Windows\SysWOW64\eventviewer.exe
              • Size 88KB
              • SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 472B
              • SHA256 9d7407b8bcd4af6820eae7da00db7598246d0f58dc502ef3c89aacbd9cc8a104
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 594B
              • SHA256 6b1bed1fa21d7c0e263368370908c45833a12819d8133a2ad14c8b74972c675a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmReport.ini
              • Path C:\Windows\Temp\ArmReport.ini
              • Size 724B
              • SHA256 75c515a974331642bba2005b0d0764cde29ffd6ac526a700e27b9de049c0c6bc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ArmUI.ini
              • Path C:\Windows\Temp\ArmUI.ini
              • Size 234KB
              • SHA256 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download