8a994b1e88576d00df004cdaa9a96b547881440c5703d92f0ec9cef8cda0f61d

General

Target
2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
Size 560KB
Sample260416-jfc3ssdw71
SHA256 8a994b1e88576d00df004cdaa9a96b547881440c5703d92f0ec9cef8cda0f61d
MD5 98c9156863857926156b55153a1df776
SHA1 1f4252ca663d232fc12fbd12061409af57c473ac
SHA512 27a34613138cbd9c99dead3b75177382283db6df4b1776971bb488dc2bc09c6a4e35732ebae67b1633dc3261d0492f7a302ecbb8b04ce1a58007609080395cb4
SSDEEP 12288:a4fb9PACuMxpKhMfAvd2TsWweCmNI9o45IKbde/wAWFSkclvPV7Z:XjNzjMNk/w5Qkmr
TLSH
T1BEC46B057BB08136EB96433449A6E76A5966ED781B6481CFF3E43E7D1D302C36A3720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1152	SVCHOST.EXE
1880	iexp1orer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexp1orer.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\startplay.wav	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
File created	C:\Program Files\Windows Media Player\SVCHOST.EXE	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexp1orer.exe	iexp1orer.exe
File created	C:\Program Files\Internet Explorer\iexp1orer.exe	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SVCHOST.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Play_Animations = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Display Inline Videos = "no"	iexp1orer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\Enable AutoImageResize = "no"	iexp1orer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
1880	iexp1orer.exe
1880	iexp1orer.exe
1880	iexp1orer.exe
1880	iexp1orer.exe
1880	iexp1orer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 5144	1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	80
PID 1404 wrote to memory of 1880	1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	84
PID 1404 wrote to memory of 2912	1404	2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_98c9156863857926156b55153a1df776_amadey_darkgate_elex_smoke-loader_stop_wannacry.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\1776326721.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5144
- C:\Program Files\Internet Explorer\iexp1orer.exe
  "C:\Program Files\Internet Explorer\iexp1orer.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1880
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912

C:\Program Files\Windows Media Player\SVCHOST.EXE
"C:\Program Files\Windows Media Player\SVCHOST.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1776326721.bat

Path C:\1776326721.bat
Size 783B
SHA256 1ea8688d913f2d214eac53b4425e830271d962ae4e03812914cfa142824fada8
MD5 678cb25e3e3cdc2e4a37fd9545178034
SHA1 d54d52116e81f41409a6276fe19e37b015936caa
SHA512 58fc997896713df5e848c5d1088dc052b9e1aaad1f16cc17e1058ddacde2fdf8d8153b6791aeaedc9da9c6b83e9760b9ab537adf153cf311960fd4bd8a888296
TLSH
T1DA01FD46CC3B43F0E100A049B72E8D84AE0FF10993E0080B139B7E10AC4199AB6E240D
MD5 SHA1 SHA512 TLSH

Submit Download

iexp1orer.exe

Path C:\Program Files\Internet Explorer\iexp1orer.exe
Size 40KB
SHA256 223f9ed55d6b851790df45da8ebbae94de04a84dea1d5f5b9344c4612cc8c2fd
MD5 b17fcc08fad1a036200822a49421c761
SHA1 0f327a3d1d7d7e4b97a78d4698d54e6df85d6344
SHA512 37a1e6acf40438911993441eb35bafbb6d8e9b0a8c59f0754fd3ccd5cb7233a42bcd30715257aa6d1f9972c1dcdfdf9ae3e0a2e79f00351f48f3010ac08665cc
SSDEEP 768:4t7tn/xXr+Y070KVhIXdwyre4cL331SbGaqkL:MXw0KzILe4w1Sqa
TLSH
T1870349233A67449ECB27DDB265AF17AED37BA2B21D248657D3422E0D5D34902FD1232C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SVCHOST.EXE

Path C:\Program Files\Windows Media Player\SVCHOST.EXE
Size 20KB
SHA256 ff3d7155725d3074e80cda561af09852ca45737a6cc54689a22472e4031ee844
MD5 9ca9d0cd3a192be67bc69f88364f1533
SHA1 4aacb4278abafa54aad20de0829a88ee0cfe7129
SHA512 0d520b3c6965668737d78ef2fa78416ee6dd7b947d3821436e400ba9508322e6d703554bbd958f925f83983df249c441687849c616eb4b4a458e43b5d1aa3218
SSDEEP 192:BpHAbp6YlpTOfaCgOKUTTacRxvviK5WRIW9oBN8GETjN564oyntfR:BVAQYiHgOKUTTTN6UWWW9IAvN564LR
TLSH
T1D39209434D98D473DBC3B073891E651A5F7BB26871F4AE0386C51B4D68A8EF2CC3554A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startplay.wav

Path C:\Program Files\Windows Media Player\startplay.wav
Size 54B
SHA256 3368443266155f4fa9d232905ec522d9db0b2e3146d33d049ce9d3dfc4303fad
MD5 4a7091db02f1e3e05dabb92203f5fcca
SHA1 faa7ee2cc6196ec16b627cdb199db37ef0b9c22d
SHA512 ed8b233c4184f11b58b06d3dbbed183fc6a0d74d0bf579102708e26c1bbcd091275a533aaf4376c2620fa27479499db9c213c499c504193a7570d3319173cd64
TLSH
T191900281454B8554720224804741255026519424D54845B5FE9C475E65CB55440647E6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads