2257b8a5e396e655147b8bda28eedb8fd24e36b9136598e9a5c4b868e38d1041

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/05/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260510-243bpsbw4r
SHA256 2257b8a5e396e655147b8bda28eedb8fd24e36b9136598e9a5c4b868e38d1041
MD5 abdad8fe666531ac1eaf3a4eca357344
SHA1 da7463fdb42f5e36e9b240f2593da10ee6762eac
SHA512 3369ca7c2fe6e3270a6155af5b2539c79bead4a9ed551dca010765db7dab928e20f85ce43daff8dae85b07fa852e9e4338f4f08ecd466a31504f90806dea9495
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroA/:yIAFGzIaeK70K78/
TLSH
T14BB38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1384	fsmfpyl.exe
4528	fsmfpyl.exe
2912	fsmfpyl.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fsmfpyl.exe	2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\fsmfpyl.exe	fsmfpyl.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2520	1384	WerFault.exe	80
4976	2912	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsmfpyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsmfpyl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsmfpyl.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1384	fsmfpyl.exe
1384	fsmfpyl.exe
2912	fsmfpyl.exe
2912	fsmfpyl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	fsmfpyl.exe
Token: SeDebugPrivilege	2912	fsmfpyl.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3104	1384	fsmfpyl.exe	53
PID 2912 wrote to memory of 3104	2912	fsmfpyl.exe	53

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-10_abdad8fe666531ac1eaf3a4eca357344_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3144

C:\PROGRA~3\Mozilla\fsmfpyl.exe
C:\PROGRA~3\Mozilla\fsmfpyl.exe -pucfxad
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 516
  2⤵
  - Program crash
  PID:2520

C:\PROGRA~3\Mozilla\fsmfpyl.exe
C:\PROGRA~3\Mozilla\fsmfpyl.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1384 -ip 1384
1⤵
PID:3024

C:\PROGRA~3\Mozilla\fsmfpyl.exe
C:\PROGRA~3\Mozilla\fsmfpyl.exe -pucfxad
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 488
  2⤵
  - Program crash
  PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2912 -ip 2912
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fsmfpyl.exe

Path C:\ProgramData\Mozilla\fsmfpyl.exe
Size 107KB
SHA256 ee78fd258cc7182e8ab3a0f67f5f6cb3629f4cc31c6748a9094b5d411d70f259
MD5 0022c972cb3969ca4e1df785a5a3a5c6
SHA1 1440648036a4d8b2b23983dcf17d31e0b1df0744
SHA512 79ee55aab98e483197ee8239d8e34f2a93bf0903bc822202fc8c39974644de4e7fc9d2cd6277dd32a7f5dd2e7f6a4b55ab0d783b7ad099f9f1b3378fc2af43f3
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroAx:yIAFGzIaeK70K78x
TLSH
T170B38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsmfpyl.exe

Path C:\ProgramData\Mozilla\fsmfpyl.exe
Size 107KB
SHA256 e593e8c2c0fa0644610b756facf52b2295dfe39fce6b651d49c81e738643e20a
MD5 849be50ea20bd4eaa19e5df59cafceda
SHA1 690117431ac946c300c29ec156367e407e687885
SHA512 21088972172da5487577290ac891c8f6f9b6977838a567a67e3c5f66f06e70f662fb957177b8569df84ac6b9ec07ce5a10dab7cefa01886ebc4ed127dadbe56e
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroAj:yIAFGzIaeK70K78j
TLSH
T107B38E41F3D0DD66F05C253180A746B30BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3104-4-0x0000000003350000-0x000000000336C000-memory.dmp

Download

memory/4528-6-0x00000000000A0000-0x00000000000FEF1C-memory.dmp

Download