Overview

overview

7

Static

static

3

2026-05-22...op.exe

windows10-2004-x64

7

2026-05-22...op.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    22/05/2026, 02:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop.exe
  • Size 1.5MB
  • Sample260522-cjkhqact9k
  • SHA256 9c20c96e238921bc70799083d22f7451cfdb3c8c8a53016cd89014f1b4371746
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverytrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 30 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop.exe"
    1⤵
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop​.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop​.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3812

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ie_to_edge_stub.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
        • Size 838KB
        • SHA256 0d4b42f5a666fce9065b61824d7c246a6bd8e7dd45530bcd78b838beb4776d31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        • Size 7.3MB
        • SHA256 6bec353506022d9a090e5844d9f1d7136d1e4eec3672281e4bff27f772f9cbae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
        • Size 4.8MB
        • SHA256 a46d4b04acfebb90e13de75bce83890d9bddc62d35f8b2493e1a2def525304be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_proxy.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
        • Size 1.7MB
        • SHA256 767d7d9a31c038afc4bba03450eb6bf4067cad363e5719e384c8167c27473833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0e58076d.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\0e58076d.tmp
        • Size 2.8MB
        • SHA256 8f06d1012269d09b7d794421b0bdf0f02c93f0d77449e734d8d21e9c0baecd00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop​.exe
        • Path C:\Users\Admin\AppData\Local\Temp\2026-05-22_1609fc8412968d6a01c166505b54a529_amadey_darkgate_elex_smoke-loader_stealc_stop​.exe
        • Size 1.2MB
        • SHA256 7ad84ac3f1b32eaa8caff6cb9abac2064a444d51a89af094690df697edb2f6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fpb.tmp
        • Path C:\Windows\SysWOW64\Macromed\Temp\{F07563C2-3DBA-4C6D-91AC-58ABFD770E49}\fpb.tmp
        • Size 529KB
        • SHA256 bd32581e890c288ce1848dffe2b7ac0eabdd701f2ae9f731b1a60dab3c6609fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download