ae85ecf52dd80675beb96044bbf4b6c2768d9f100f1dae223012bdf696f7ddfd

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260419-p7ch8sa13j
SHA256 ae85ecf52dd80675beb96044bbf4b6c2768d9f100f1dae223012bdf696f7ddfd
MD5 eee5599c4d7025cf795cc899162d478c
SHA1 bb4dc82b59ac1fa42f68faf28a5a75d20130f637
SHA512 d4c60b562d5a42cc9593112e9d169777282c7e7bb75cd52432642885302ea1db209aa1b6330d147634de562b52803c51aed14eed78d4f46d484e588144e8fb02
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYrok:Iw3/ExWPIFK70K7Q
TLSH
T193848D41B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3288	imkvcmi.exe
3352	imkvcmi.exe
3156	imkvcmi.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\imkvcmi.exe	2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\imkvcmi.exe	imkvcmi.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3908	3288	WerFault.exe	80
1744	3156	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imkvcmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imkvcmi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	imkvcmi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3288	imkvcmi.exe
3288	imkvcmi.exe
3156	imkvcmi.exe
3156	imkvcmi.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	imkvcmi.exe
Token: SeDebugPrivilege	3156	imkvcmi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 3128	3288	imkvcmi.exe	53
PID 3156 wrote to memory of 3128	3156	imkvcmi.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3128
- C:\Users\Admin\AppData\Local\Temp\2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-19_eee5599c4d7025cf795cc899162d478c_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2392

C:\PROGRA~3\Mozilla\imkvcmi.exe
C:\PROGRA~3\Mozilla\imkvcmi.exe -cglrcxe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 516
  2⤵
  - Program crash
  PID:3908

C:\PROGRA~3\Mozilla\imkvcmi.exe
C:\PROGRA~3\Mozilla\imkvcmi.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3288 -ip 3288
1⤵
PID:4272

C:\PROGRA~3\Mozilla\imkvcmi.exe
C:\PROGRA~3\Mozilla\imkvcmi.exe -cglrcxe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 496
  2⤵
  - Program crash
  PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3156 -ip 3156
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imkvcmi.exe

Path C:\ProgramData\Mozilla\imkvcmi.exe
Size 380KB
SHA256 6862f546b371de5542319434f7edf279f3af40f45d27fa751057fb2fef308ce5
MD5 fa550241f15cd92fdec05a897b221fac
SHA1 6ae5d655c5488d882585ac49f8d7586de32d1be3
SHA512 fa079e5bbf9835df4f714ac237414aa60ec8c5c32d30c341212af1eadf109242245993f43ffeebc8471136df5bb40e4eacb4210d869af6dff8cea453c45ecd43
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYrof:Iw3/ExWPIFK70K7j
TLSH
T1E6848D01B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imkvcmi.exe

Path C:\ProgramData\Mozilla\imkvcmi.exe
Size 380KB
SHA256 b7a8104a14e79c315d5c38ca6a40714f5064864cd2efb67489c0778a97623b05
MD5 9b3729a662d564cb44a06df4d008d9b8
SHA1 575f50ad8af442526ab9af95b2ad7693ca824d75
SHA512 b388b84f1f84e73f2330a0fcb34dcf0ff7d5c48443968fb46d67789d5d3364b9e3f4e474ffaee45796cba609c0162252ec1858dd9baef5ec197a8f638dc03819
SSDEEP 3072:dO+a83/ExbyGsZI5eil+BC3K5eqU+BC3K5eqYrot:Iw3/ExWPIFK70K75
TLSH
T16D848D41B3D0CD66F5AC353194B386B20AB5FC0296B125AB17D83BAFDD702A05A76F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-4-0x00000000026C0000-0x00000000026DC000-memory.dmp

Download

memory/3352-7-0x0000000000340000-0x000000000039F000-memory.dmp

Download