ea9b9b04138fa28e5594b2264aa8ce5cb834eaa45834efc9d8a1818b586f6e4e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260419-pcbcpaew8w
SHA256 ea9b9b04138fa28e5594b2264aa8ce5cb834eaa45834efc9d8a1818b586f6e4e
MD5 851ab71b9fba0f7ed58a82b9be57e517
SHA1 53d91e0aea0ac9fc3dd1644a0d4af3f3f03839c3
SHA512 db858cb6a2a2ab885b77d46dc80529e21e75596812529545a7e7763ac557ae210fdb348e947b393b4e068ead96d81666094af0d25c44d2a07191d9682c5dc028
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYro/:yIAFGrIaeK70K7b
TLSH
T1F5B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3260	gnrvbyg.exe
2696	gnrvbyg.exe
5716	gnrvbyg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\gnrvbyg.exe	2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\gnrvbyg.exe	gnrvbyg.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1260	3260	WerFault.exe	79
1480	5716	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gnrvbyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gnrvbyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gnrvbyg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3260	gnrvbyg.exe
3260	gnrvbyg.exe
5716	gnrvbyg.exe
5716	gnrvbyg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	gnrvbyg.exe
Token: SeDebugPrivilege	5716	gnrvbyg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3112	3260	gnrvbyg.exe	53
PID 5716 wrote to memory of 3112	5716	gnrvbyg.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3112
- C:\Users\Admin\AppData\Local\Temp\2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-19_851ab71b9fba0f7ed58a82b9be57e517_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2632

C:\PROGRA~3\Mozilla\gnrvbyg.exe
C:\PROGRA~3\Mozilla\gnrvbyg.exe -neumybf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 516
  2⤵
  - Program crash
  PID:1260

C:\PROGRA~3\Mozilla\gnrvbyg.exe
C:\PROGRA~3\Mozilla\gnrvbyg.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3260 -ip 3260
1⤵
PID:2188

C:\PROGRA~3\Mozilla\gnrvbyg.exe
C:\PROGRA~3\Mozilla\gnrvbyg.exe -neumybf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5716 -s 496
  2⤵
  - Program crash
  PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5716 -ip 5716
1⤵
PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gnrvbyg.exe

Path C:\ProgramData\Mozilla\gnrvbyg.exe
Size 107KB
SHA256 7023125a25059fea5a05e43620db4019f4e3eae058f584b32438e7e3e7daec9a
MD5 a3606c2e4be0eeaccfed3ffc9a7bdcfa
SHA1 9d54fec2476957faa8a4d05b0549b45d03361bb4
SHA512 e986b0439ccd09df6607be635f6ce788b41b8b3a03f48982ac19f068e6e03ae53a978c818a479824493a545c5784a0198a73a1480a070c73f4d0c07569ba3530
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYrox:yIAFGrIaeK70K7V
TLSH
T1A1B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gnrvbyg.exe

Path C:\ProgramData\Mozilla\gnrvbyg.exe
Size 107KB
SHA256 12c0f902ec3cf6d88777bcd8ca3b7efbbdd111e40893f19fa74ffc64f1125a7c
MD5 37e986549d23a62d028b155196906947
SHA1 7b7b40e011a31938a9380efd56bdbf829a6f0808
SHA512 2054474d7ecea75e18e6ca8b498a6d566ef6bd53d5d6d0eb8383258d0491c93d592bb9e433c4df5fda493e2d3e4cf596311a929c19abe79c0b1acc935cad1a87
SSDEEP 3072:L+Oa8AFGisZI5e+MO+BC3K5eqU+BC3K5eqYroE:yIAFGrIaeK70K7A
TLSH
T1B7B38E41F3C0DD66F05C253184A746B30BB5EC1697B125AB27983BAFED702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-7-0x0000000000BD0000-0x0000000000C2EF1C-memory.dmp

Download

memory/3112-4-0x0000000002530000-0x000000000254C000-memory.dmp

Download