f6f6bfd012a1e38cbc043ba41019e8395ed3d74f06df77b8be5133e5f25ce21a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260424-qapyqsbt4k
SHA256 f6f6bfd012a1e38cbc043ba41019e8395ed3d74f06df77b8be5133e5f25ce21a
MD5 7c52c084452cdaa56d6bf64d729af5cc
SHA1 2f175c2c3e14b6e919db69529e5e3426134c02c9
SHA512 d445eac17bd6f0e69c349a0cbac7b1743e250a264370688e81070452300e580a089a7bdb4a44fae41fb5519e3199a062f513748a83dddb4a4129ca43d39e0735
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJj:iX9yBfYK70K7Nj
TLSH
T1A8848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05AB6F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4600	iaokteb.exe
2324	iaokteb.exe
3316	iaokteb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\iaokteb.exe	2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\iaokteb.exe	iaokteb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3856	4600	WerFault.exe	85
1520	3316	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaokteb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaokteb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iaokteb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4600	iaokteb.exe
4600	iaokteb.exe
3316	iaokteb.exe
3316	iaokteb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	iaokteb.exe
Token: SeDebugPrivilege	3316	iaokteb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3300	4600	iaokteb.exe	56
PID 3316 wrote to memory of 3300	3316	iaokteb.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3300
- C:\Users\Admin\AppData\Local\Temp\2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4780

C:\PROGRA~3\Mozilla\iaokteb.exe
C:\PROGRA~3\Mozilla\iaokteb.exe -dmdxzll
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 504
  2⤵
  - Program crash
  PID:3856

C:\PROGRA~3\Mozilla\iaokteb.exe
C:\PROGRA~3\Mozilla\iaokteb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4600 -ip 4600
1⤵
PID:3944

C:\PROGRA~3\Mozilla\iaokteb.exe
C:\PROGRA~3\Mozilla\iaokteb.exe -dmdxzll
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 476
  2⤵
  - Program crash
  PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3316 -ip 3316
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iaokteb.exe

Path C:\ProgramData\Mozilla\iaokteb.exe
Size 380KB
SHA256 9bad995c32326fb2e95b8e2bed92295f7c2fa38672cc256350f2f04e5b9407ce
MD5 95b093df3339d9f7b109b8b464ff021b
SHA1 990250a66b8d0f5ea9434df49c26ce30c9b9942a
SHA512 afec9ec395532fd599145300c2662246c4ac73a872844029bf66653168aa8c6a004e9d2961d3e63a0b0acc2ebc5649be9b0cd0ceb19ff1563f833d9d3f4b6702
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJC:iX9yBfYK70K7NC
TLSH
T14D848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05AB6F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iaokteb.exe

Path C:\ProgramData\Mozilla\iaokteb.exe
Size 380KB
SHA256 43982e1d90dc646f03a3505062ece2218018ae9eaf32318346cb4b0b2ff87b38
MD5 394b2ea4a673c0f790ef54f6822bfc48
SHA1 1a780b24cdb7d5bb3a23c2f32fefc289ff9d3535
SHA512 d49f1897f88b6598a140b03e0068a16e6c66c0a236a9f7f58d2b7067cc40aabfe2ae8f9c71b0096161d6ffcc7200455a3790694a4ceb0c5ca2450dee9378db24
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJV:iX9yBfYK70K7NV
TLSH
T14C848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05AB6F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2324-7-0x0000000000490000-0x00000000004EF000-memory.dmp

Download

memory/3300-4-0x0000000002550000-0x000000000256C000-memory.dmp

Download