14c1006afee65aef3611ece541b1ca51f2340871c89f1c795c6878710dd159fd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_60215a509e611fad9bb06e790a0402cb_amadey_darkgate_elex_smoke-loader.exe
Size 89KB
Sample260601-jaa19aex6w
SHA256 14c1006afee65aef3611ece541b1ca51f2340871c89f1c795c6878710dd159fd
MD5 60215a509e611fad9bb06e790a0402cb
SHA1 c5b57fd5dc2e0dbca2a028f18c908ed1cac085d3
SHA512 7fed3c20995543cd4632ed35e10b12dbe8a1f04a1e308a019d9704693218bcbf7db26ae1f919ed6e36c934026d90b8d432be0d2eb38553c57aef82c17e8fc41d
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTiId:wCCSUacxmurlg0v4iRZCpr
TLSH
T1A593062163E841B2E2765F3CC1B2A2C1062A7D527EF1F14F5D8436D94F736C0AAB1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2648	guzakbet.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	checkip.dyndns.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_60215a509e611fad9bb06e790a0402cb_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guzakbet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2648	2152	2026-06-01_60215a509e611fad9bb06e790a0402cb_amadey_darkgate_elex_smoke-loader.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-01_60215a509e611fad9bb06e790a0402cb_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_60215a509e611fad9bb06e790a0402cb_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guzakbet.exe

Path C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
Size 89KB
SHA256 bbf61933ad81df214d8dc3a7f36dface175c6c1bd3b2175f27eba8fc0393d522
MD5 0682ccb176fe6ff068f5afb87fd15d2f
SHA1 08de0a5e3040b5c4f6176fc99718eb7f36ee1e7d
SHA512 632de2f03f77ba3b6ee4c2173800c04fb2d35222afa13bc46ade5a683042f2285b38d22403bfd5713db46b3f5d9a3489d1a36112b4187b4e2356abfe885251c8
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTiILz:wCCSUacxmurlg0v4iRZCpJ
TLSH
T16793062163E841B2E2765F3CC1B2A2C1162A7D527EF1F14F5D8436D94F736C0AAB1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download