Analysis

  • max time kernel
    131s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250619-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 18:54

General

  • Target

    2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe

  • Size

    754KB

  • MD5

    e7a1294ae66a9b255f984b45c5a1a3e6

  • SHA1

    4fa6fff2aa486b9ad08829b914926635bc7c5e2b

  • SHA256

    b9bb7ad541c02f06c2549a3fe83e484d8e8ea551801e3e01f2c80996477aa043

  • SHA512

    38a850cc7f19283ee0eeae9bb2a37c335dc06c742ecd07e2deba974aac83a7a73de845fc10aa65653c327676572c93c7150e6b54c745235b45bf133743cb62ab

  • SSDEEP

    12288:amhjKOXdUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxiOqOF:thLalj3DSudvGM3MXTVhtSQWGtxt

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 8 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\ckbmppfjrh.exe
      "C:\Users\Admin\AppData\Local\Temp\ckbmppfjrh.exe" "C:\Users\Admin\AppData\Local\Temp\eyvqtgbium.exe" "C:\Users\Admin\AppData\Local\Temp\2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Users\Admin\AppData\Local\Temp\2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe
        "C:\Users\Admin\AppData\Local\Temp\2025-07-02_e7a1294ae66a9b255f984b45c5a1a3e6_amadey_darkgate_elex_rhadamanthys_smoke-loader.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4656
    • C:\Users\Admin\AppData\Local\Temp\ahqfdrwdcu.exe
      C:\Users\Admin\AppData\Local\Temp\ahqfdrwdcu.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Windows\System32\cmd.exe
        /c sc config msdtc obj= LocalSystem
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\system32\sc.exe
          sc config msdtc obj= LocalSystem
          4⤵
          • Launches sc.exe
          PID:4284
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TKylaJrf.bat"
        3⤵
          PID:5284
        • C:\Windows\System32\bindsvc.exe
          "C:\Windows\System32\bindsvc.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5940
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:3128
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
        2⤵
        • Modifies data under HKEY_USERS
        PID:4576

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\TKylaJrf.bat

            Filesize

            196B

            MD5

            2aa1c2e2b881440b7cf00772019f5b71

            SHA1

            6b872e826591df25b0c4e052c3423e3a53ec045d

            SHA256

            8cccbf3a938d5af45b633117d172ca05686e46858bf1849d058899bd274c292a

            SHA512

            427d961386cf0de21a561cb0f6edd881b0ed10802c510a721c225c54a89b56d583a1baa49222317639dfa4eef3f98e194c2a6f50b7c729d0c33c33d5e023708e

          • C:\Users\Admin\AppData\Local\Temp\ahqfdrwdcu.exe

            Filesize

            580KB

            MD5

            2c2029588ad8b86759c17b7ae885ee03

            SHA1

            91653b5344d4c210201218e2f215dd5228d76799

            SHA256

            3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

            SHA512

            88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

          • C:\Users\Admin\AppData\Local\Temp\ckbmppfjrh.exe

            Filesize

            51KB

            MD5

            e48b89715bf5e4c55eb5a1fed67865d9

            SHA1

            89a287da39e14b02cdc284eb287549462346d724

            SHA256

            c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

            SHA512

            4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

          • C:\Users\Admin\AppData\Local\Temp\eyvqtgbium.exe

            Filesize

            38KB

            MD5

            f659ba68d92152adb1b88fece9c9bda5

            SHA1

            c5b10c7b66b35bcbd7e1ab6cd36bb8439d80214d

            SHA256

            b1955a36fee6be734dbe3fd7f68eec972cbaf9af4b694f3bf718f85689e2235a

            SHA512

            de4b9764291100b40d9bd6620d1ef19c9552760441d266073017f577e2f8475e4884a6ce5587bd045f7e90e2faf1f97b229965974f1fd81cf58140b6d05098f0

          • C:\Windows\System32\bindsvc.exe

            Filesize

            291KB

            MD5

            7c5b397fb54d5aa06bd2a6fb99c62fee

            SHA1

            a9e0bf7bbabf6ab9e294156985537ae972ebd743

            SHA256

            d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

            SHA512

            daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

          • memory/1228-37-0x000001CEE1630000-0x000001CEE1640000-memory.dmp

            Filesize

            64KB

          • memory/1228-21-0x000001CEE1410000-0x000001CEE1420000-memory.dmp

            Filesize

            64KB

          • memory/1228-53-0x000001CEE99F0000-0x000001CEE99F8000-memory.dmp

            Filesize

            32KB

          • memory/1228-55-0x000001CEE9BF0000-0x000001CEE9BF8000-memory.dmp

            Filesize

            32KB

          • memory/3380-15-0x0000000000EA0000-0x000000000101A000-memory.dmp

            Filesize

            1.5MB

          • memory/3380-152-0x0000000000EA0000-0x000000000101A000-memory.dmp

            Filesize

            1.5MB

          • memory/3380-145-0x0000000000EA0000-0x000000000101A000-memory.dmp

            Filesize

            1.5MB

          • memory/4576-102-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-108-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-78-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-80-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-81-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-84-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-85-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-86-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-88-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-89-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-87-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-83-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-82-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-90-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-91-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-92-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-93-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-95-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-94-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-96-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-100-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-99-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-98-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-104-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-105-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-103-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-77-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-101-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-97-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-106-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-107-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-79-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-111-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-110-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-109-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-112-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-113-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-121-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-120-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-119-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-118-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-117-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-116-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-115-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-114-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-122-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-123-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-124-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-125-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-127-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-126-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-128-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-129-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-133-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-131-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-132-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-130-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-74-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-76-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4576-75-0x0000019154910000-0x0000019154920000-memory.dmp

            Filesize

            64KB

          • memory/4656-70-0x0000000000BF0000-0x0000000000C00000-memory.dmp

            Filesize

            64KB

          • memory/4656-71-0x0000000005B10000-0x00000000060B4000-memory.dmp

            Filesize

            5.6MB

          • memory/4656-72-0x0000000005600000-0x0000000005692000-memory.dmp

            Filesize

            584KB

          • memory/4656-73-0x00000000055F0000-0x00000000055FA000-memory.dmp

            Filesize

            40KB