f6f6bfd012a1e38cbc043ba41019e8395ed3d74f06df77b8be5133e5f25ce21a

General

Target
2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260424-qapyqsbt4k
SHA256 f6f6bfd012a1e38cbc043ba41019e8395ed3d74f06df77b8be5133e5f25ce21a
MD5 7c52c084452cdaa56d6bf64d729af5cc
SHA1 2f175c2c3e14b6e919db69529e5e3426134c02c9
SHA512 d445eac17bd6f0e69c349a0cbac7b1743e250a264370688e81070452300e580a089a7bdb4a44fae41fb5519e3199a062f513748a83dddb4a4129ca43d39e0735
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJj:iX9yBfYK70K7Nj
TLSH
T1A8848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05AB6F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3100	axlaesa.exe
3468	axlaesa.exe
2540	axlaesa.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\axlaesa.exe	2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\axlaesa.exe	axlaesa.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
428	3100	WerFault.exe	80
4960	2540	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axlaesa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axlaesa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axlaesa.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3100	axlaesa.exe
3100	axlaesa.exe
2540	axlaesa.exe
2540	axlaesa.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	axlaesa.exe
Token: SeDebugPrivilege	2540	axlaesa.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3116	3100	axlaesa.exe	53
PID 2540 wrote to memory of 3116	2540	axlaesa.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3116
- C:\Users\Admin\AppData\Local\Temp\2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-24_7c52c084452cdaa56d6bf64d729af5cc_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:1540

C:\PROGRA~3\Mozilla\axlaesa.exe
C:\PROGRA~3\Mozilla\axlaesa.exe -weabkki
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 516
  2⤵
  - Program crash
  PID:428

C:\PROGRA~3\Mozilla\axlaesa.exe
C:\PROGRA~3\Mozilla\axlaesa.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3100 -ip 3100
1⤵
PID:4848

C:\PROGRA~3\Mozilla\axlaesa.exe
C:\PROGRA~3\Mozilla\axlaesa.exe -weabkki
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 496
  2⤵
  - Program crash
  PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2540 -ip 2540
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axlaesa.exe

Path C:\ProgramData\Mozilla\axlaesa.exe
Size 380KB
SHA256 46d4e22c7455439cb883c6cc7d37317e65df20797f54e63ccd58dd44066053e2
MD5 7aa39add3ea1277cb210798a72923c26
SHA1 22a046aac4ba48f12db96eea1fbb96f5d69ea9de
SHA512 d83a2bc6254033ba34122c8fe22e28a8fe8cbb1fa95314a0c92f97abe413ab61f33a4ec0e89d310758f033981606e2d78dd01a4a32052f3f63487bc116ea65b8
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJC:iX9yBfYK70K7NC
TLSH
T166848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05AB6F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axlaesa.exe

Path C:\ProgramData\Mozilla\axlaesa.exe
Size 380KB
SHA256 1889acf62f3bfe6108daedbedef3b6b9e171081350a8cf63d35b58f70bc3efee
MD5 2b7d538526d9da03875cb0f65e71ffa8
SHA1 08721f90dc5b9b574f4b2a91aff788c718c985de
SHA512 cacce8ea381b3c2d04f95160e48f6284ed88b6382cb37643101b88ac73aa2c666cce2b69454f4c52777fa3f974725426089701d3b6805a1d15c3ac05d45c758b
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJZ:iX9yBfYK70K7NZ
TLSH
T1F4848E00F3C0DD76E16C2535C4A346720B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-3-0x0000000001280000-0x000000000133B000-memory.dmp

Download

memory/2540-12-0x00000000015F0000-0x00000000016AB000-memory.dmp

Download

memory/3100-6-0x0000000001320000-0x00000000013DB000-memory.dmp

Download

memory/3116-5-0x0000000002BC0000-0x0000000002BDC000-memory.dmp

Download

memory/3468-9-0x0000000000A20000-0x0000000000A7F000-memory.dmp

Download

memory/3468-10-0x0000000001480000-0x000000000153B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads