2257b8a5e396e655147b8bda28eedb8fd24e36b9136598e9a5c4b868e38d1041

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/05/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260510-243bpsbw4r
SHA256 2257b8a5e396e655147b8bda28eedb8fd24e36b9136598e9a5c4b868e38d1041
MD5 abdad8fe666531ac1eaf3a4eca357344
SHA1 da7463fdb42f5e36e9b240f2593da10ee6762eac
SHA512 3369ca7c2fe6e3270a6155af5b2539c79bead4a9ed551dca010765db7dab928e20f85ce43daff8dae85b07fa852e9e4338f4f08ecd466a31504f90806dea9495
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroA/:yIAFGzIaeK70K78/
TLSH
T14BB38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3240	cbtexsb.exe
3576	cbtexsb.exe
1548	cbtexsb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\cbtexsb.exe	2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\cbtexsb.exe	cbtexsb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2176	3240	WerFault.exe	89
696	1548	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbtexsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbtexsb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbtexsb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3240	cbtexsb.exe
3240	cbtexsb.exe
1548	cbtexsb.exe
1548	cbtexsb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	cbtexsb.exe
Token: SeDebugPrivilege	1548	cbtexsb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3244	3240	cbtexsb.exe	56
PID 1548 wrote to memory of 3244	1548	cbtexsb.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4428

C:\PROGRA~3\Mozilla\cbtexsb.exe
C:\PROGRA~3\Mozilla\cbtexsb.exe -tfadizd
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 504
  2⤵
  - Program crash
  PID:2176

C:\PROGRA~3\Mozilla\cbtexsb.exe
C:\PROGRA~3\Mozilla\cbtexsb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3240 -ip 3240
1⤵
PID:1428

C:\PROGRA~3\Mozilla\cbtexsb.exe
C:\PROGRA~3\Mozilla\cbtexsb.exe -tfadizd
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 484
  2⤵
  - Program crash
  PID:696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1548 -ip 1548
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cbtexsb.exe

Path C:\ProgramData\Mozilla\cbtexsb.exe
Size 107KB
SHA256 49ca009bed8800b335a6ba431d12b8cdb700d9ead74939ca3c57ae92a00c27d0
MD5 cc675db39df0c3f73c217c2784e4e923
SHA1 1c94b9c30d433b424814f49f037951a5d9a13571
SHA512 e6f46fc15c4981abe828f4e10db54348a1cbe05c4d79f678b4bf4eb68849f01c1f547a3e9e83743601c5962f93f809b187d2f033b0ffd04f243ad3978de897c0
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroAd:yIAFGzIaeK70K78d
TLSH
T192B38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbtexsb.exe

Path C:\ProgramData\Mozilla\cbtexsb.exe
Size 107KB
SHA256 68d41dc81dc298fa68fdb4d6705e616856b48940da9c27ad23f7a302c591768c
MD5 f41dbc0d95a2f92badcd37fab6d22ff7
SHA1 cc03bc4f838d37723197071c6939d00739d6ffc0
SHA512 f0185e63135199e1cf21568300004d6edac1bb11fe88f560adcbef78061705a2f832278cca0ceba35233793c5a8ac85216d533e298702e9227977699e3bebcec
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroA5:yIAFGzIaeK70K785
TLSH
T1EAB38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3244-4-0x0000000001320000-0x000000000133C000-memory.dmp

Download

memory/3576-7-0x0000000000800000-0x000000000085EF1C-memory.dmp

Download