ea9b9b04138fa28e5594b2264aa8ce5cb834eaa45834efc9d8a1818b586f6e4e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260419-pcbcpaew8w
SHA256 ea9b9b04138fa28e5594b2264aa8ce5cb834eaa45834efc9d8a1818b586f6e4e
MD5 851ab71b9fba0f7ed58a82b9be57e517
SHA1 53d91e0aea0ac9fc3dd1644a0d4af3f3f03839c3
SHA512 db858cb6a2a2ab885b77d46dc80529e21e75596812529545a7e7763ac557ae210fdb348e947b393b4e068ead96d81666094af0d25c44d2a07191d9682c5dc028
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYro/:yIAFGrIaeK70K7b
TLSH
T1F5B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5140	vtrukac.exe
3692	vtrukac.exe
4652	vtrukac.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\vtrukac.exe	2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\vtrukac.exe	vtrukac.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5976	5140	WerFault.exe	87
2416	4652	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrukac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrukac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrukac.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5140	vtrukac.exe
5140	vtrukac.exe
4652	vtrukac.exe
4652	vtrukac.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5140	vtrukac.exe
Token: SeDebugPrivilege	4652	vtrukac.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 3280	5140	vtrukac.exe	56
PID 4652 wrote to memory of 3280	4652	vtrukac.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3280
- C:\Users\Admin\AppData\Local\Temp\2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4784

C:\PROGRA~3\Mozilla\vtrukac.exe
C:\PROGRA~3\Mozilla\vtrukac.exe -xattmpj
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5140 -s 504
  2⤵
  - Program crash
  PID:5976

C:\PROGRA~3\Mozilla\vtrukac.exe
C:\PROGRA~3\Mozilla\vtrukac.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5140 -ip 5140
1⤵
PID:3336

C:\PROGRA~3\Mozilla\vtrukac.exe
C:\PROGRA~3\Mozilla\vtrukac.exe -xattmpj
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 484
  2⤵
  - Program crash
  PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4652 -ip 4652
1⤵
PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vtrukac.exe

Path C:\ProgramData\Mozilla\vtrukac.exe
Size 107KB
SHA256 8f00c498b1c7c0908dd59f42354b2752326b2eab56290b4b89a93f17c2754e9a
MD5 abb2e6f464c09752ab5533ffd1c00567
SHA1 892e659f71ecf6b070d5c3074e188ccb3a10cadd
SHA512 b575624588928a5203a79c2752452b56670ed5f1d2557125d0b277004ee147f33a57606b147f8de6603e814bc7d27fac487fce13b7cdf6ca76c1de19efb890e7
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYrog:yIAFGrIaeK70K7s
TLSH
T1E5B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrukac.exe

Path C:\ProgramData\Mozilla\vtrukac.exe
Size 107KB
SHA256 c4b09c5ac81728d2b9c219d584fa89c93276dd3bba76ba85e495308d2db28d4e
MD5 e3ec0cd18d09cf5d57885a0079096953
SHA1 9b79ac37402aeed03a7d05367178b34f5a817eae
SHA512 5fd7d1b5fd4f7fef1bdd4e0c149f99f4280c2d05beca2613040e75cdff4261e104fa4c798d698768328f3a1615e26945ee85d05a9d089f8a9aefa4f9fd7258b0
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYroa:yIAFGrIaeK70K72
TLSH
T1C1B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3280-4-0x0000000001110000-0x000000000112C000-memory.dmp

Download

memory/3692-7-0x0000000000D30000-0x0000000000D8EF1C-memory.dmp

Download