Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
06/05/2026, 07:59
General
- Target 2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe
- Size 16.2MB
- Sample260506-jvsf2ahs4q
- SHA256 eb22b74d3091ced68d5a0367e95de4d9398cc427186ad37db88ffb71067b5945
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_e69f5e451496a2c95e82de35d07fb6e4_amadey_coinminer_darkgate_elex_smoke-loader_stealc.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3232-0-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-1-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-4-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-15-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-11-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-9-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-7-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-6-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-23-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-418-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-439-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-653-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-654-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-645-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-635-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-630-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-619-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-611-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-604-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-597-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-589-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-582-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-575-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-566-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-560-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-545-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-546-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-538-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-524-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-517-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-509-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-502-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-495-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-488-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-481-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-474-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-467-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-460-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-453-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-446-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-438-0x00000000778D2000-0x00000000778D3000-memory.dmp
memory/3232-430-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-423-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-421-0x0000000000F00000-0x0000000000F48000-memory.dmp
memory/3232-415-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-412-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-410-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-409-0x000000007F010000-0x000000007F011000-memory.dmp
memory/3232-659-0x000000007F190000-0x000000007F1B0000-memory.dmp
memory/3232-672-0x000000007F1C0000-0x000000007F1C1000-memory.dmp
memory/3232-723-0x0000000002F00000-0x0000000002F51000-memory.dmp