d2c8eab788034ad309217454a6eee6e7986899c118d3d99d3ef21da95a4d5388

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0e28f91aefe7fa14688c728403a18036_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260701-2d2bqafv5q
SHA256 d2c8eab788034ad309217454a6eee6e7986899c118d3d99d3ef21da95a4d5388
MD5 0e28f91aefe7fa14688c728403a18036
SHA1 8193337b09cee1e1ce7fcf6d47371f7924db1f3d
SHA512 6778bc97167427e5027f170393a2453c0847f72137d320f1685fca612a7182b15b53459c79fee1abe3ec88e468efded4b2eb9e21d9f20d48f6360ca762dea7f8
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJH:mh7c54FK70K7NH
TLSH
T1BDB38E41F3C0DD76E05C2531846346B20BB5ED1697B165AB27883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1848	guvtkud.exe
1992	guvtkud.exe
700	guvtkud.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\guvtkud.exe	2026-07-01_0e28f91aefe7fa14688c728403a18036_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\guvtkud.exe	guvtkud.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5552	1848	WerFault.exe	88
2520	700	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guvtkud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0e28f91aefe7fa14688c728403a18036_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guvtkud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guvtkud.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1848	guvtkud.exe
1848	guvtkud.exe
700	guvtkud.exe
700	guvtkud.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1848	guvtkud.exe
Token: SeDebugPrivilege	700	guvtkud.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3468	1848	guvtkud.exe	51
PID 700 wrote to memory of 3468	700	guvtkud.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3468
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_0e28f91aefe7fa14688c728403a18036_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-01_0e28f91aefe7fa14688c728403a18036_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:716

C:\PROGRA~3\Mozilla\guvtkud.exe
"C:\PROGRA~3\Mozilla\guvtkud.exe" -kkouawe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 528
  2⤵
  - Program crash
  PID:5552

C:\PROGRA~3\Mozilla\guvtkud.exe
C:\PROGRA~3\Mozilla\guvtkud.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1848 -ip 1848
1⤵
PID:3004

C:\PROGRA~3\Mozilla\guvtkud.exe
"C:\PROGRA~3\Mozilla\guvtkud.exe" -kkouawe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 512
  2⤵
  - Program crash
  PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 700 -ip 700
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guvtkud.exe

Path C:\ProgramData\Mozilla\guvtkud.exe
Size 106KB
SHA256 014547b2a8637d23fda34804f3d934c218b1847458c2ce40be3245d1d7674984
MD5 72525c49e8ff96aa508676ca7454ca33
SHA1 c740be973429017dd3c5a95382a70a77bcb0910c
SHA512 d1cb195aaf20d79d8b9dc102cb099db182fe9bf384694e3c825547722a843108a3b341749d4481cdd62ee991f8976125d896c16bc7b806d4f370b36780cad886
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJt:mh7c54FK70K7Nt
TLSH
T161B38E41F3C0DD76E05C2531846346B20BB5ED1697B165AB27883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guvtkud.exe

Path C:\ProgramData\Mozilla\guvtkud.exe
Size 106KB
SHA256 0a8fdba9c85bfa64d17e96dffae1e44f4a2eb85a9d07a8f576e92db8cc2ebb62
MD5 20c2b9357df948e28edb9c501815775b
SHA1 2ce94d4ce5df11a1ec0a3484317947b7dd251355
SHA512 a6a971e0c0564702acfb37f54dd344d10d74bc27d0ba4f031f618c762ae92350b014f2331cde98f1a1e6ffdfdf78bd5e180458b7cc46d18971e8c68d051fbd7d
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJQ:mh7c54FK70K7NQ
TLSH
T15DB38E41F3C0DD76E05C2531846346B20BB5ED1697B165AB27883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-6-0x0000000000150000-0x00000000001AF000-memory.dmp

Download

memory/3468-4-0x0000000003370000-0x000000000338C000-memory.dmp

Download