ae85ecf52dd80675beb96044bbf4b6c2768d9f100f1dae223012bdf696f7ddfd

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260419-p7ch8sa13j
SHA256 ae85ecf52dd80675beb96044bbf4b6c2768d9f100f1dae223012bdf696f7ddfd
MD5 eee5599c4d7025cf795cc899162d478c
SHA1 bb4dc82b59ac1fa42f68faf28a5a75d20130f637
SHA512 d4c60b562d5a42cc9593112e9d169777282c7e7bb75cd52432642885302ea1db209aa1b6330d147634de562b52803c51aed14eed78d4f46d484e588144e8fb02
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYrok:Iw3/ExWPIFK70K7Q
TLSH
T193848D41B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
552	fhfifvb.exe
4168	fhfifvb.exe
4968	fhfifvb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fhfifvb.exe	2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\fhfifvb.exe	fhfifvb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4300	552	WerFault.exe	84
3796	4968	WerFault.exe	91

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fhfifvb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
552	fhfifvb.exe
552	fhfifvb.exe
4968	fhfifvb.exe
4968	fhfifvb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	fhfifvb.exe
Token: SeDebugPrivilege	4968	fhfifvb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3268	552	fhfifvb.exe	56
PID 4968 wrote to memory of 3268	4968	fhfifvb.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4388

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe -zgfokjc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 504
  2⤵
  - Program crash
  PID:4300

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 552 -ip 552
1⤵
PID:3400

C:\PROGRA~3\Mozilla\fhfifvb.exe
C:\PROGRA~3\Mozilla\fhfifvb.exe -zgfokjc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 476
  2⤵
  - Program crash
  PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4968 -ip 4968
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fhfifvb.exe

Path C:\ProgramData\Mozilla\fhfifvb.exe
Size 380KB
SHA256 c50be55386617679c6ff8ed6122ee9a177106ce6757cc42a25f4fe80054081c2
MD5 8ee577477558d3f1605096b2e0f1fefe
SHA1 482ceaf1fab09a187fbc49bffa480c5efa2fe26a
SHA512 67e4cc43ef429c4858f0972f94ea22d5e13eb9b9dac2f2e078116f1a558c3917d3316ca8f8b3add606073c7756a8e9e83ce055f5da41ff3cc3a0814cd9e6d71a
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYroN:Iw3/ExWPIFK70K7Z
TLSH
T1CF848D41B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhfifvb.exe

Path C:\ProgramData\Mozilla\fhfifvb.exe
Size 380KB
SHA256 0e210366e6117340ee71fef6b35372f16f0a0da0b13c9987596fd2bfcc569529
MD5 541013b41aab984fe0920da18a2f896f
SHA1 5c057f3b395dec03c81053bddaa3ea3b1b6b6949
SHA512 c3fa8c1d7e0fda539c5a8f234017962b5fe156a25744ce93950c7f848408d06b78752236adfce7e2ffd97103ee9b56540025de12a1ed57ce83b8136f77e4d9e6
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYroI:Iw3/ExWPIFK70K7U
TLSH
T19A848D41B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3268-4-0x0000000001430000-0x000000000144C000-memory.dmp

Download

memory/4168-7-0x0000000000540000-0x000000000059F000-memory.dmp

Download