8a994b1e88576d00df004cdaa9a96b547881440c5703d92f0ec9cef8cda0f61d

General

Target
2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
Size 560KB
Sample260416-jfc3ssdw71
SHA256 8a994b1e88576d00df004cdaa9a96b547881440c5703d92f0ec9cef8cda0f61d
MD5 98c9156863857926156b55153a1df776
SHA1 1f4252ca663d232fc12fbd12061409af57c473ac
SHA512 27a34613138cbd9c99dead3b75177382283db6df4b1776971bb488dc2bc09c6a4e35732ebae67b1633dc3261d0492f7a302ecbb8b04ce1a58007609080395cb4
SSDEEP 12288:a4fb9PACuMxpKhMfAvd2TsWweCmNI9o45IKbde/wAWFSkclvPV7Z:XjNzjMNk/w5Qkmr
TLSH
T1BEC46B057BB08136EB96433449A6E76A5966ED781B6481CFF3E43E7D1D302C36A3720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	SVCH0ST.EXE
2364	SVCHOST.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SVCHOST.EXE

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\SVCHOST.EXE	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
File created	C:\Program Files\Windows Media Player\startplay.wav	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
File created	C:\Program Files\Windows Media Player\SVCH0ST.EXE	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\SVCHOST.EXE	SVCHOST.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCH0ST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCHOST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Play_Animations = "no"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Display Inline Videos = "no"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "no"	SVCHOST.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
2364	SVCHOST.EXE
2364	SVCHOST.EXE
2364	SVCHOST.EXE
2364	SVCHOST.EXE
2364	SVCHOST.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3948	2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	86
PID 2116 wrote to memory of 2364	2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	90
PID 2116 wrote to memory of 1516	2116	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\1776326723.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3948
- C:\Program Files\Internet Explorer\SVCHOST.EXE
  "C:\Program Files\Internet Explorer\SVCHOST.EXE"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1516

C:\Program Files\Windows Media Player\SVCH0ST.EXE
"C:\Program Files\Windows Media Player\SVCH0ST.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1776326723.bat

Path C:\1776326723.bat
Size 785B
SHA256 353bace13d3607c4e5ec973836683279522c1b399f38976205e7d0923ab62b02
MD5 f9a500a1b712aad6a350e405a947d565
SHA1 8ebcfad02b26ba7cbc5fb12725c24a5036a0c3ad
SHA512 7ccbca2f7f4ab664ec92068a838afaf2624e155fe14ad40beff1271cdf9cc612b48c07b6baa1be98d21318cfdd33bb812f818db2c7a0e88013b947002a79ae67
TLSH
T1F601FD468C3B43F0E111A08EBB2A9D84AE0BF10993E0080B139A7E11AC4199AB6E214E
MD5 SHA1 SHA512 TLSH

Submit Download

SVCHOST.EXE

Path C:\Program Files\Internet Explorer\SVCHOST.EXE
Size 40KB
SHA256 223f9ed55d6b851790df45da8ebbae94de04a84dea1d5f5b9344c4612cc8c2fd
MD5 b17fcc08fad1a036200822a49421c761
SHA1 0f327a3d1d7d7e4b97a78d4698d54e6df85d6344
SHA512 37a1e6acf40438911993441eb35bafbb6d8e9b0a8c59f0754fd3ccd5cb7233a42bcd30715257aa6d1f9972c1dcdfdf9ae3e0a2e79f00351f48f3010ac08665cc
SSDEEP 768:4t7tn/xXr+Y070KVhIXdwyre4cL331SbGaqkL:MXw0KzILe4w1Sqa
TLSH
T1870349233A67449ECB27DDB265AF17AED37BA2B21D248657D3422E0D5D34902FD1232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCH0ST.EXE

Path C:\Program Files\Windows Media Player\SVCH0ST.EXE
Size 20KB
SHA256 ff3d7155725d3074e80cda561af09852ca45737a6cc54689a22472e4031ee844
MD5 9ca9d0cd3a192be67bc69f88364f1533
SHA1 4aacb4278abafa54aad20de0829a88ee0cfe7129
SHA512 0d520b3c6965668737d78ef2fa78416ee6dd7b947d3821436e400ba9508322e6d703554bbd958f925f83983df249c441687849c616eb4b4a458e43b5d1aa3218
SSDEEP 192:BpHAbp6YlpTOfaCgOKUTTacRxvviK5WRIW9oBN8GETjN564oyntfR:BVAQYiHgOKUTTTN6UWWW9IAvN564LR
TLSH
T1D39209434D98D473DBC3B073891E651A5F7BB26871F4AE0386C51B4D68A8EF2CC3554A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startplay.wav

Path C:\Program Files\Windows Media Player\startplay.wav
Size 52B
SHA256 0441fb94cc981aa294cb3b7108a5145c65ce49d94c5f0cb33d33f7341446444c
MD5 59cce11e38cb02fccee0b2ab1b29ffa6
SHA1 5cb1449d8ad203746e66a251bafe82049b2e5cfa
SHA512 669d9b49470d1ca5d6603dc9020001242305ba1cc23281d05753bfc064081699f35bb6e79f3bbb45329dff3bdf953151130cc5183772058a9984c62c7931286a
TLSH
T1F890028145058544B10224900340691036584858D6CA58A5BA9C4747658B52048246B1
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads