4e0ac325852ae44ffd9149c54691d750d8cf476e936801fb957d77c794b00a49

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9e9217d03832fa2b9b43742068e09e1d_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260415-npsxtscy2k
SHA256 4e0ac325852ae44ffd9149c54691d750d8cf476e936801fb957d77c794b00a49
MD5 9e9217d03832fa2b9b43742068e09e1d
SHA1 c28f14b841bfd498bc1b0e536bdd00da6cd732aa
SHA512 386e09865ea655f143cc72c6d137da2c35a64a75e87567ad6608ac765aa384b01612fd0d733b6e83153cc9691668689c445b063205641830099bddc82200acc8
SSDEEP 3072:OyaB37VWlXs/58l+BC3K5eqU+BC3K5eqYroJm:OVRWlXJK70K7Nm
TLSH
T155847D40F3C0DD77E06C253190A346731B79ED1697A165AB27983BAFDC702A06A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1216	fhfifvb.exe
2396	fhfifvb.exe
3960	fhfifvb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fhfifvb.exe	2026-04-15_9e9217d03832fa2b9b43742068e09e1d_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\fhfifvb.exe	fhfifvb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4348	1216	WerFault.exe	84
3824	3960	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9e9217d03832fa2b9b43742068e09e1d_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1216	fhfifvb.exe
1216	fhfifvb.exe
3960	fhfifvb.exe
3960	fhfifvb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	fhfifvb.exe
Token: SeDebugPrivilege	3960	fhfifvb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3240	1216	fhfifvb.exe	56
PID 3960 wrote to memory of 3240	3960	fhfifvb.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3240
- C:\Users\Admin\AppData\Local\Temp\2026-04-15_9e9217d03832fa2b9b43742068e09e1d_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-15_9e9217d03832fa2b9b43742068e09e1d_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4712

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe -zgfokjc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 504
  2⤵
  - Program crash
  PID:4348

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1216 -ip 1216
1⤵
PID:4248

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe -zgfokjc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 480
  2⤵
  - Program crash
  PID:3824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3960 -ip 3960
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fhfifvb.exe

Path C:\ProgramData\Mozilla\fhfifvb.exe
Size 380KB
SHA256 4b9423cc38513eb55d50cb7bc6e08fa3c26388833ad1b3abdf4df93fddcfc7a0
MD5 8bd6181644cd8f5ac03884f4084d9f9a
SHA1 d311e9c718a2d8fb702051551bcddf11ca0fab96
SHA512 f01e7a7c8244d45d57f9317c99f415938d8eff9bc295b695a72e58caa8628fdeb2f2b49d40d1bbbd675ad44a8b543cac8072845eedf784e36e54d566a7b6201e
SSDEEP 3072:OyaB37VWlXs/58l+BC3K5eqU+BC3K5eqYroJC:OVRWlXJK70K7NC
TLSH
T12C847D40F3C0DD77E06C253190A346731B79ED1697A165AB27983BAFDC702A06A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhfifvb.exe

Path C:\ProgramData\Mozilla\fhfifvb.exe
Size 380KB
SHA256 83c4e5b7912cc76d0175716ed77b6e87e8908004636c35cf7991b92237dacb44
MD5 d978f7f8ce8ac17a5804129ac65b909f
SHA1 c1446996dc98f7636010c7398a30e5dc0a3e3df4
SHA512 a20fd71b90090a58fca858689cb26e98e00a7b5161b6ad8bf1b913dfd2193d500e6371adfe1bfdf02890b6042b3f882f4b6c96fa23389fd6cdf74b10ed3c3f53
SSDEEP 3072:OyaB37VWlXs/58l+BC3K5eqU+BC3K5eqYroJt:OVRWlXJK70K7Nt
TLSH
T14F847D40F3C0DD77E06C253190A346731B79ED1697A165AB27983BAFDC702A06A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-4-0x0000000000928000-0x0000000000929000-memory.dmp

Download

memory/2396-9-0x0000000000920000-0x000000000097EF00-memory.dmp

Download

memory/3240-6-0x0000000002AA0000-0x0000000002ABC000-memory.dmp

Download

memory/4712-0-0x0000000000058000-0x0000000000059000-memory.dmp

Download