976676e15fe7c2d1b8074f53b9983933984171277a970c8e7e1d671a7c505689

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Size 4.7MB
Sample260511-scaypscx9t
SHA256 976676e15fe7c2d1b8074f53b9983933984171277a970c8e7e1d671a7c505689
MD5 2a3029598c741844ba8f713bbcb2c82c
SHA1 50d5d5c6032881bdd1514378f61bf47de21785ce
SHA512 2809db0b81aee47f750491f68a2c63cfaf921e1e57f9bf73d3f6c3f335f78127c92efa76ad92f6f048624d16f412998273055eed051044e88c29c7cef7aacda1
SSDEEP 98304:lnAQff5+yN0EDi026vPOLGxJJJG65CvuqaYGoDdGgbQyDlSih/FFhCX9wQR+XYzt:lL5T1PpJy65CvuH1wdtbQyMKkX9wQR+E
TLSH
T1563601257AA2C076D7323130969AA77AE7BDB9309B7542E727D01D3C2E305C2593C26F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b248-5.dat	UPX
behavioral2/memory/3388-13-0x0000000000570000-0x0000000000B71000-memory.dmp	UPX
behavioral2/memory/3388-20-0x0000000000570000-0x0000000000B71000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
3388	irsetup.exe

Loads dropped DLL 1 IoCs

pid	Process
3388	irsetup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001c00000002b248-5.dat	upx
behavioral2/memory/3388-13-0x0000000000570000-0x0000000000B71000-memory.dmp	upx
behavioral2/memory/3388-20-0x0000000000570000-0x0000000000B71000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3388	irsetup.exe
3388	irsetup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3388	2776	2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:3857346 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\2026-05-11_2a3029598c741844ba8f713bbcb2c82c_amadey_darkgate_elex_redline-stealer_smoke-loader_stealc.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2122505878-652277452-2375749442-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.8MB
SHA256 9e822a377f2b1936e6685b0b7763952ce4d23500af5b5ba220de53917d2b34e5
MD5 2ec2a3f1accdb59942f23cfa0a852608
SHA1 42d166ec87e6cc8a34e15d0f4021a377388ebb34
SHA512 25d30f61e27bb8af7cb46c6e120aef979f24f419235a30b4c7afd1d30b35799563048210e9f6eb72a00e9029ff37d08d700837631fcb07e70d9f7f53aa6b536d
SSDEEP 49152:bo5xdLZj7eHEWcSkMqQjeDlSvKjoSCpWmp8728hLFhC:boDdGgbQyDlSih/FFhC
TLSH
T1BC853341E166C38AC17C447FACBB5D95671EAFD67321C7E20BA9BC1FB436B522C48890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.3.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.3.dll
Size 395KB
SHA256 eef58c3dae331da03872b973230aa56b40e34035035cca5b468eda0c40daa819
MD5 8d18dbd14d7c233b0d1f5943226c35b7
SHA1 57de3e8d8e1f0e39244b3528310e513c7f90c5fa
SHA512 39777b070c6ea791ee5cdc1c8ad50015e9d6f6f96b2d8e02f4a80f97a7fa2c438770d5015eca5d19106cfce624b6a247de04cb4ce6baad353acbb298f0fc6aaa
SSDEEP 12288:B3yJ6pmOZCR40mbwkOMMe6uDa6H5FrCp6pFVY:IaLbwKLDTH5+6pFVY
TLSH
T14084BE41F283C0B2E6A411B996B49F774D78745A5336D0FBABE018B59E203F1777A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-22-0x0000000000AD0000-0x0000000000AF5000-memory.dmp

Download

memory/3388-13-0x0000000000570000-0x0000000000B71000-memory.dmp

Download

memory/3388-20-0x0000000000570000-0x0000000000B71000-memory.dmp

Download

memory/3388-21-0x0000000001190000-0x00000000011B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads