a449d07e9d6b772138893b56b9b9e3b211bfb1c70322b371a9f589228dba5dbc

Analysis

max time kernel
150s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe
Size 793KB
Sample260629-bfacxaa12l
SHA256 a449d07e9d6b772138893b56b9b9e3b211bfb1c70322b371a9f589228dba5dbc
MD5 fb246e6c3e5291aa880396a76efb0550
SHA1 b500339c332edf46a815a8cac07db99c179c038f
SHA512 3cceb342d9962f5b6f813b42d35a1d8f83439d1db4214b80a93e519b5e9bf136ecb7186a3696632d3d13eff9d1ff0838f588276443ae23fb8a37d5ab60d6689a
SSDEEP 12288:QwqidIawsWTg2Q5CT0ct+pXRqT4HrUgstMAKXbqLwZ8jrQWqUcQh7XYcJmo:Qnissx5sT0NlQgoKLZJvYLm
TLSH
T1B105F0023781D0B1DA7305325F759B41867EFD205E65AA07BBD83E4DE9354C2EE32BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1384	2SwziVG1nuxeOg.exe
4964	JjMy363NC26.exe
3580	YGDi8zQrs.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2SwziVG1nuxeOg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JjMy363NC26.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YGDi8zQrs.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1384	3224	2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe	89
PID 3224 wrote to memory of 4964	3224	2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe	90
PID 3224 wrote to memory of 3580	3224	2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_fb246e6c3e5291aa880396a76efb0550_darkgate_elex_magniber_silence_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\1569674041\2SwziVG1nuxeOg.exe
  C:\Users\Admin\AppData\Local\Temp\1569674041\2SwziVG1nuxeOg.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1384
- C:\Users\Admin\AppData\Local\Temp\1569674041\JjMy363NC26.exe
  C:\Users\Admin\AppData\Local\Temp\1569674041\JjMy363NC26.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Users\Admin\AppData\Local\Temp\1569674041\YGDi8zQrs.exe
  C:\Users\Admin\AppData\Local\Temp\1569674041\YGDi8zQrs.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2SwziVG1nuxeOg.exe

Path C:\Users\Admin\AppData\Local\Temp\1569674041\2SwziVG1nuxeOg.exe
Size 359KB
SHA256 989f279cfdc576bcbf26df31f5cab7598fde5b66498507c94d00e6c60b2b4e6c
MD5 d95052b0950181cf8864e67e13774e48
SHA1 463ce9072e5639bf6a0c8d014a3b5fbd0040ac04
SHA512 7c9a00c84fa27fedb244731a473a141f87011fc777e19acb81a448e91cb8b188c4cdbadb53599b0d8ff6957a23c146530dcb76b969f9f1ecd2736d902284933f
SSDEEP 3072:aexbl+P6gvDR9+e5f4fMGPN1BQgYI0i4pb/Rpy+/FSmoWLHBoxbphDBHZDZT7pae:aexWXr2PN1BQEN4JRpy6LaJp97pb
TLSH
T1D674FC02214BE3A0C59183B106179A40C93DEE7FBFD1372FA664F56845703CA75BAEA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f9qW2.ini

Path C:\Users\Admin\AppData\Local\Temp\1569674041\4f9qW2.ini
Size 18KB
SHA256 5c538cd14fbc3f89804e20ee31bf7365847e2f5c0a5cad7a2e051a0cfaf55719
MD5 1b8d1669f6f8697b1bf626eb3090302a
SHA1 1345ce97b0a4229ad205f1e2291556aaed52113e
SHA512 439e024c3afb5eed9c0f4d7b8bca73b19f11d348c70eb30d2821e98b187d454e5e45e70888046e14ecd3262f4327fde00ac498d2e2f97ed6f7bc1c01934ea538
SSDEEP 384:V8o9OSlrJ2L89A79YD0TvfDuj5SmpRn8aCI+28TFYy+8MdExfSg1tPuF1ZTfdBi9:V8o9OSlrwL89A79YD0TnDuj5SmpRn8aG
TLSH
T1DB827A94B530F6CB681EE62994F94148180F53CC8B36E43F64DF86918187C9A5F9BEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JjMy363NC26.exe

Path C:\Users\Admin\AppData\Local\Temp\1569674041\JjMy363NC26.exe
Size 356KB
SHA256 d8a74410ef4dfe5d1511853a894e3b6ec921a6c5838717888d4a9a2629089747
MD5 90716d080dea2a0dc5a894025910eaa7
SHA1 3167600cd15e90053d99ee5ac58bfe3df51f78b9
SHA512 6673ac833e8cf850198441e93f4489619bb94192ff3868c625e6d8859fb93f46d0e9dd280f6ecf2a6415ce10947cc10175956112b1f4d1e2e1cbad459ff36d54
SSDEEP 6144:qNACyk5Bikx6C1aEix3O8aki8dPBdWsG/LM9SXfAxUarVXh:qNzNQkx6Shixe09h
TLSH
T1CE744A2177C28030C2A20C310B1BAB61C67DBDA95DA6879FD7F5651DD530BCBA930B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YGDi8zQrs.exe

Path C:\Users\Admin\AppData\Local\Temp\1569674041\YGDi8zQrs.exe
Size 366KB
SHA256 9f59bb80506de489d06a4029873ea62659e1168e6de04847281d8385ba23385a
MD5 e94bdb4a57ce39359a6c92d2f4c83573
SHA1 5e2736ac3c4af1a1d0e73abe1975c4f0bd53372a
SHA512 d6844ce8bbc7c7728d40adf3bbc140bece3a0ac763e461bd937c7bb9639476923b205fb62d99a58964ccaea12caafc626962bbc39dd204014731d3fb2f8b15f7
SSDEEP 3072:6CNOOuKw+LrkH+NGqwakM2CMSuLdGhdp+kquZ+7gzbHEG2YD3+ude6xbSjOA4qX0:XJwakFCEG3y6gBG5LXxbSjOA4qtZh
TLSH
T1F884A78533A656B6C5A005700519DB60E668DC6B2BF4235BB68A3DBC4CF0FC37A17E4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads