ef2e1cd6620d0dcb3c4b82b88c1087ddf84a5c5592d86728014d28db5f6b02e0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 00:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_f70d22ef5e0ae51108e6f7c66e523fb0_amadey_darkgate_elex_smoke-loader.exe
Size 88KB
Sample260519-bbc81aay4n
SHA256 ef2e1cd6620d0dcb3c4b82b88c1087ddf84a5c5592d86728014d28db5f6b02e0
MD5 f70d22ef5e0ae51108e6f7c66e523fb0
SHA1 0663bf42a9a80702f2d2820468eff44cc1057e25
SHA512 a388189bfd96b376fd986b43d7ee802a009aed0be7777abb4b27fa4a11fdeb0c3a73f95753d72eb888e056cc8eb0e057205e20b740a3dc97b783b6e53d9b8617
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTid:wCCSUacxmurlg0v4iRZCpy
TLSH
T11F93172163E840B2E2765F3CC1B2A6D1062A7D527EF1F14F6D8435D94F736C0AAB1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2976	guzakbet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_f70d22ef5e0ae51108e6f7c66e523fb0_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guzakbet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2976	2452	2026-05-19_f70d22ef5e0ae51108e6f7c66e523fb0_amadey_darkgate_elex_smoke-loader.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-19_f70d22ef5e0ae51108e6f7c66e523fb0_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_f70d22ef5e0ae51108e6f7c66e523fb0_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guzakbet.exe

Path C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
Size 89KB
SHA256 04da01a5560760c3f2490e8eec90613b50d295a288b7587d983c897b7f424980
MD5 1550c2fd1551fcb88c0337134c4aa14e
SHA1 c02bc3a45190acc4b3aaf57472a2d494e2fbda6b
SHA512 058e7cb202f2fffc07de9b13c6c5616c94fb823eb0297e2df0f8c4bae00429506e3c8a464ac8473dd057261feb5887797b4d64162e687d8fb8b935e2a903cb33
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTidz:wCCSUacxmurlg0v4iRZCp2
TLSH
T13B93172163E840B2E2765F3CC1B2A2D1062A7D527EF1F14F6D8475D94F736C0AAB1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download