dc8a187ed786aae8f29eb9f98ebeebb637e475d03c8cd1ded193e9e5ced4728d

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_f9a36a7004f5d111d6d15219fa1d16c9_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260702-mrrl4sgs2x
SHA256 dc8a187ed786aae8f29eb9f98ebeebb637e475d03c8cd1ded193e9e5ced4728d
MD5 f9a36a7004f5d111d6d15219fa1d16c9
SHA1 77975ac223843e7c89fed58073c1d3d5f6fa42d6
SHA512 0697400d1b3f6b8e5e540d109ecc86adc3b938ff2a1ffc9965ec0ce1d554041f4ac54a7def912a7194577135fae602dd218324c513b0c347cddb08a582a735fb
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYrob:ARBuA6AIIK70K7X
TLSH
T1D0848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1300	laxitsk.exe
5068	laxitsk.exe
6004	laxitsk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\laxitsk.exe	2026-07-02_f9a36a7004f5d111d6d15219fa1d16c9_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\laxitsk.exe	laxitsk.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2748	1300	WerFault.exe	88
5204	6004	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_f9a36a7004f5d111d6d15219fa1d16c9_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laxitsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laxitsk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laxitsk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1300	laxitsk.exe
1300	laxitsk.exe
6004	laxitsk.exe
6004	laxitsk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	laxitsk.exe
Token: SeDebugPrivilege	6004	laxitsk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3476	1300	laxitsk.exe	52
PID 6004 wrote to memory of 3476	6004	laxitsk.exe	52

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\2026-07-02_f9a36a7004f5d111d6d15219fa1d16c9_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-02_f9a36a7004f5d111d6d15219fa1d16c9_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3268

C:\PROGRA~3\Mozilla\laxitsk.exe
"C:\PROGRA~3\Mozilla\laxitsk.exe" -fwarpqe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 468
  2⤵
  - Program crash
  PID:2748

C:\PROGRA~3\Mozilla\laxitsk.exe
C:\PROGRA~3\Mozilla\laxitsk.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1300 -ip 1300
1⤵
PID:2944

C:\PROGRA~3\Mozilla\laxitsk.exe
"C:\PROGRA~3\Mozilla\laxitsk.exe" -fwarpqe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6004 -s 500
  2⤵
  - Program crash
  PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6004 -ip 6004
1⤵
PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

laxitsk.exe

Path C:\ProgramData\Mozilla\laxitsk.exe
Size 380KB
SHA256 7b7c6941375745d54b79c32a3d55d1f1e50eaaae17b82f790e297f6f5851639a
MD5 e517dcfcb1f0c260fc11582907d8dace
SHA1 e5b81b23470615c4570ee9cdc7b036046bcf27b9
SHA512 6f51485fe98b9839e02652bb55ce09c3361c92e163c9cb4a969a781d5fa3540543e5b7731381fb22c7db215607aa73f34c10b30e096d263668be3b06bc1d46b2
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYrob:ARBuA6AIIK70K7v
TLSH
T184848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laxitsk.exe

Path C:\ProgramData\Mozilla\laxitsk.exe
Size 380KB
SHA256 176dfb77c6f71528f68bbd102a738f710f1244b9af5bb0966d6351080e82d3a1
MD5 8762ba8625241a5c34ac6d7f1c8d8735
SHA1 361fdaeaaea92db2702e78ca814ff5301264ae43
SHA512 64e74241adbb640bf158cae2d0e33fea925f5ed8728430dd399fbbb4ecb9077b2105b0233e9787ccd8adbca6e52a677089dac6de04d2be5e7187ece3d8ad51d0
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroC:ARBuA6AIIK70K72
TLSH
T1E7848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-4-0x0000000000778000-0x0000000000779000-memory.dmp

Download

memory/3268-0-0x00000000001B8000-0x00000000001B9000-memory.dmp

Download

memory/3476-6-0x0000000006D70000-0x0000000006D8C000-memory.dmp

Download

memory/5068-9-0x0000000000770000-0x00000000007CEF1C-memory.dmp

Download