32d2648d259dfce6e5102f4c8845e09b9624e478640e0343a41e4b0c5245de45

Analysis

max time kernel
149s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_92ab937fc46a88d352ccaa0c2fcf7b75_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260608-2evwbsgw2j
SHA256 32d2648d259dfce6e5102f4c8845e09b9624e478640e0343a41e4b0c5245de45
MD5 92ab937fc46a88d352ccaa0c2fcf7b75
SHA1 a87c4bdd4b9f22ed6453e34a4fa6570b50b367b6
SHA512 79485ecab032806fae9714d951189d1406b4fc92c7869df24805c0133431eb71f242bb830686bb80f2fc9627927e353d3134be1df03e6725fa5d4d8bdbcdd196
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJW:mh7c5dFK70K7NW
TLSH
T1DCB38D41F3C0DD76E05C2531846346B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4272	akcuvwg.exe
5040	akcuvwg.exe
5260	akcuvwg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\akcuvwg.exe	2026-06-08_92ab937fc46a88d352ccaa0c2fcf7b75_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\akcuvwg.exe	akcuvwg.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4052	4272	WerFault.exe	80
5952	5260	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akcuvwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akcuvwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akcuvwg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_92ab937fc46a88d352ccaa0c2fcf7b75_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4272	akcuvwg.exe
4272	akcuvwg.exe
5260	akcuvwg.exe
5260	akcuvwg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	akcuvwg.exe
Token: SeDebugPrivilege	5260	akcuvwg.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3284	4272	akcuvwg.exe	54
PID 5260 wrote to memory of 3284	5260	akcuvwg.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3284
- C:\Users\Admin\AppData\Local\Temp\2026-06-08_92ab937fc46a88d352ccaa0c2fcf7b75_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-08_92ab937fc46a88d352ccaa0c2fcf7b75_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4932

C:\PROGRA~3\Mozilla\akcuvwg.exe
C:\PROGRA~3\Mozilla\akcuvwg.exe -dmupfen
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 516
  2⤵
  - Program crash
  PID:4052

C:\PROGRA~3\Mozilla\akcuvwg.exe
C:\PROGRA~3\Mozilla\akcuvwg.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4272 -ip 4272
1⤵
PID:5088

C:\PROGRA~3\Mozilla\akcuvwg.exe
C:\PROGRA~3\Mozilla\akcuvwg.exe -dmupfen
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 488
  2⤵
  - Program crash
  PID:5952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 5260 -ip 5260
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

akcuvwg.exe

Path C:\ProgramData\Mozilla\akcuvwg.exe
Size 106KB
SHA256 0b5a4d8df3e281151064d040fb9bb39f1279c41c887f1d6a25bd73d679b94443
MD5 14f589979b25d464953f5f09552c6e34
SHA1 7bd1e26e36efa8e18866ef8c1a679a90dbdfd0fb
SHA512 72f0f27fdd68f5c6dd8c66239b5de5f4b77164f1f2cb29d9b9b3132bf87b004d7598cc38f8373312eb13e6a6491e5725d4b9b1f9d983dd966a8b3f07c97b4a98
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJt:mh7c5dFK70K7Nt
TLSH
T1C0B38D41F3C0DD76E05C2531846346B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

akcuvwg.exe

Path C:\ProgramData\Mozilla\akcuvwg.exe
Size 106KB
SHA256 8445972c8a359b24786589ad9d2be2bcc50825eeb7fe7d78c94e954afa7c5bd2
MD5 6379070a77f88b33d639f87fff5f3c11
SHA1 685ecaf63c5b3b3ff093d770d5e6552ac607c0c6
SHA512 5714362d2380fcdf36a3bfecd63943656e19310c3dd8982922d3801f8ba0d568d0d91ea5ceedc1cf736ee637811d4268696da58dd440e606b4ba6d84a82310d6
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJX:mh7c5dFK70K7NX
TLSH
T14CB38D41F3C0DD76E05C2531846346B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3284-4-0x0000000002E20000-0x0000000002E3C000-memory.dmp

Download

memory/5040-7-0x0000000000030000-0x000000000008F000-memory.dmp

Download