7157623ebbe91aa6febf75214d2cb329b479d8031f45e51f28f5f074429c2f67

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_31dcbe81fce5167224c79a11e3562e42_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260702-qqb2tact6l
SHA256 7157623ebbe91aa6febf75214d2cb329b479d8031f45e51f28f5f074429c2f67
MD5 31dcbe81fce5167224c79a11e3562e42
SHA1 118019d7d033dff353216332fee2bb87ea2bdb28
SHA512 7ce5923e537377f87b556aa554812658f1e22ea57a4a3d830be63c5e56025eaf5aab7b46b8d63036ce06f9509be2a8b29b06db32947666d6cf29df03b3e45f3f
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYros:ARBuA6AIIK70K7o
TLSH
T198848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5616	ppmamlj.exe
1312	ppmamlj.exe
1100	ppmamlj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ppmamlj.exe	ppmamlj.exe
File created	C:\PROGRA~3\Mozilla\ppmamlj.exe	2026-07-02_31dcbe81fce5167224c79a11e3562e42_amadey_darkgate_elex_smoke-loader.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1876	5616	WerFault.exe	89
1520	1100	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_31dcbe81fce5167224c79a11e3562e42_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppmamlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppmamlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ppmamlj.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5616	ppmamlj.exe
5616	ppmamlj.exe
1100	ppmamlj.exe
1100	ppmamlj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	ppmamlj.exe
Token: SeDebugPrivilege	1100	ppmamlj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 3480	5616	ppmamlj.exe	52
PID 1100 wrote to memory of 3480	1100	ppmamlj.exe	52

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3480
- C:\Users\Admin\AppData\Local\Temp\2026-07-02_31dcbe81fce5167224c79a11e3562e42_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-02_31dcbe81fce5167224c79a11e3562e42_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4920

C:\PROGRA~3\Mozilla\ppmamlj.exe
"C:\PROGRA~3\Mozilla\ppmamlj.exe" -towqlyf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 528
  2⤵
  - Program crash
  PID:1876

C:\PROGRA~3\Mozilla\ppmamlj.exe
C:\PROGRA~3\Mozilla\ppmamlj.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 5616 -ip 5616
1⤵
PID:3640

C:\PROGRA~3\Mozilla\ppmamlj.exe
"C:\PROGRA~3\Mozilla\ppmamlj.exe" -towqlyf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 500
  2⤵
  - Program crash
  PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1100 -ip 1100
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ppmamlj.exe

Path C:\ProgramData\Mozilla\ppmamlj.exe
Size 380KB
SHA256 59bcb1c9de5ca258f8c4755e8d0ef8bab37b0b4f138c7fee6c69aebfd5de23ea
MD5 818c8170d695fd974b44d0d2d0a01c28
SHA1 79416e91eb822453e91050c054aa71b7d969ada7
SHA512 3f8687aad0549ea6233b12e555651885159e475abc7d01c2e49e6d8cc412813528865baaa5414fedd154d08a1419a12d0b69702b0a088f1837512bb490f330ac
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYron:ARBuA6AIIK70K7b
TLSH
T108848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppmamlj.exe

Path C:\ProgramData\Mozilla\ppmamlj.exe
Size 380KB
SHA256 662cc0d8ec4ada61a0041e012baa4f4a782852f17414c49aa774c6dc3ea1ecd4
MD5 bae8cb5d997a0951603b9f1ce735994b
SHA1 a7e9364cf47b929e41c8237a5e3aee6fcf874f83
SHA512 664f4aa45fdd4c0999c73840a7b65e214d170b7704464749ec129c0c7a5317a03ae97ae1c7969354915fc4f746c382d8c3841820f7c04e9c7687cad82bc39280
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYro1:ARBuA6AIIK70K7x
TLSH
T115848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-8-0x0000000000070000-0x00000000000CEF1C-memory.dmp

Download

memory/3480-6-0x0000000002F90000-0x0000000002FAC000-memory.dmp

Download

memory/4920-0-0x0000000000C28000-0x0000000000C29000-memory.dmp

Download

memory/5616-4-0x0000000000078000-0x0000000000079000-memory.dmp

Download