8505306258a0a0138191d97479f1f0199b07745e958c79d2704e2d2dfb815eb0

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/04/2026, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_ec99a8459e754b2e6b48e12d916b5069_amadey_darkgate_elex_smoke-loader.exe
Size 88KB
Sample260425-labnwsdv4w
SHA256 8505306258a0a0138191d97479f1f0199b07745e958c79d2704e2d2dfb815eb0
MD5 ec99a8459e754b2e6b48e12d916b5069
SHA1 540e144b32ac69463a645b74a3efa1cfcc3028c3
SHA512 f727a8a8ff73ba60d33ec60d6000d40efe06519c909d326a21fbfcfec66a6453d6ef8beda1a2cc8032b24ea6a04dfe6eff6a622951386a969222e3dcda488851
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTiQ:wCCSUacxmurlg0v4iRZCpz
TLSH
T1F293272163E840B2E2765F3CC1B2A6D1062A7D527EF1F14F6E8471D94F736C0AAB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1528	guzakbet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	checkip.dyndns.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_ec99a8459e754b2e6b48e12d916b5069_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guzakbet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 1528	3392	2026-04-25_ec99a8459e754b2e6b48e12d916b5069_amadey_darkgate_elex_smoke-loader.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-25_ec99a8459e754b2e6b48e12d916b5069_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_ec99a8459e754b2e6b48e12d916b5069_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guzakbet.exe

Path C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
Size 88KB
SHA256 cf5cd8ae6dba8540d44e11d3b7f02281e616dea2f5988aea613131b2b87ac795
MD5 aba4e8cd19942e0369d0fa10c2ddfa50
SHA1 194dc53ada4afee4d96bdfb77cbc5faf7833a9e7
SHA512 c2b82fd1f02ffae147802b4361fe80728dcf8ed87dad9017a8ec38077076eb883eb3a90f6327def6b6bc0911ddb2934c96fc88c1e3793983ae4c4417363a418a
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTik:wCCSUacxmurlg0v4iRZCpn
TLSH
T1AF93182163E840B2E2765F3CC1B2A6D1062A7D527EF1F14F6E8471D94F736C0AAB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1528-5-0x0000000005190000-0x00000000051F3000-memory.dmp

Download

memory/1528-11-0x0000000005190000-0x00000000051F3000-memory.dmp