a8d8f75b085d4c59a5021d8e5b4aa8781bfa1f036b3b246ed76a41667ececefd

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_33ac28a1a441abd5ad94f411d474df12_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260704-mpmkdaat7l
SHA256 a8d8f75b085d4c59a5021d8e5b4aa8781bfa1f036b3b246ed76a41667ececefd
MD5 33ac28a1a441abd5ad94f411d474df12
SHA1 6b19edbe8081ffc2a4b8d7cca6ec4952f0d852b8
SHA512 34fad3f9eb91b32b0d8bb46dc07bed55b1aecd2f4192a941610c316e05ec459af98d94e5876a3188341c6490f33e43af3999a286673c1e4998c4a17379b7cafe
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYro+:ARBuA6AIIK70K7q
TLSH
T1B4848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3924	drcjejk.exe
2768	drcjejk.exe
4336	drcjejk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\drcjejk.exe	2026-07-04_33ac28a1a441abd5ad94f411d474df12_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\drcjejk.exe	drcjejk.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1844	3924	WerFault.exe	85
3352	4336	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_33ac28a1a441abd5ad94f411d474df12_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drcjejk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drcjejk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drcjejk.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3924	drcjejk.exe
3924	drcjejk.exe
4336	drcjejk.exe
4336	drcjejk.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3924	drcjejk.exe
Token: SeDebugPrivilege	4336	drcjejk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 3256	3924	drcjejk.exe	56
PID 4336 wrote to memory of 3256	4336	drcjejk.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3256
- C:\Users\Admin\AppData\Local\Temp\2026-07-04_33ac28a1a441abd5ad94f411d474df12_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-04_33ac28a1a441abd5ad94f411d474df12_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2856

C:\PROGRA~3\Mozilla\drcjejk.exe
C:\PROGRA~3\Mozilla\drcjejk.exe -tjxmsua
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 504
  2⤵
  - Program crash
  PID:1844

C:\PROGRA~3\Mozilla\drcjejk.exe
C:\PROGRA~3\Mozilla\drcjejk.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3924 -ip 3924
1⤵
PID:4424

C:\PROGRA~3\Mozilla\drcjejk.exe
C:\PROGRA~3\Mozilla\drcjejk.exe -tjxmsua
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 484
  2⤵
  - Program crash
  PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4336 -ip 4336
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

drcjejk.exe

Path C:\PROGRA~3\Mozilla\drcjejk.exe
Size 380KB
SHA256 28795c4f9b98b4b671c5bee3e0427bc4956074a59afd05ba29bc7931d68c8dd0
MD5 df2a86afa6deaaf00c17e280916a5bb7
SHA1 055b3c9b8b14ea6403c483ad5a9cff12710d2b8e
SHA512 90082d0adf48ccf8823650b040f187a5f8d57b1ed8396d32e335ee59a9c7e25c57f93124d1c33882b622d63e4ddf3965ef5da336c5c0032a96e6394e8128d92c
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroH:ARBuA6AIIK70K7j
TLSH
T101848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drcjejk.exe

Path C:\ProgramData\Mozilla\drcjejk.exe
Size 380KB
SHA256 c855d00acc48c9ca75bd9c909db95bd673ef8cae38a693be2f1e8c136cba6226
MD5 4b6b8e8fb1a9c7bd92b3f1ab04c7e9b4
SHA1 4c754aea34f744add6241c0aa2fe490cd385c9af
SHA512 b350c2e281771ac6d908f8938866f9438e5caf29a028f17955d0b63a79ca85cf469942271b8d730f457470f0e3300215fd91a9f28be4ea4c80fe4fdb5591cd13
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroT:ARBuA6AIIK70K73
TLSH
T1FE848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2768-10-0x0000000000560000-0x00000000005BEF1C-memory.dmp

Download

memory/2856-0-0x00007FFB6B890000-0x00007FFB6BA85000-memory.dmp

Download

memory/2856-5-0x00007FFB6B890000-0x00007FFB6BA85000-memory.dmp

Download

memory/3256-7-0x00000000028B0000-0x00000000028CC000-memory.dmp

Download

memory/3924-4-0x00007FFB6B890000-0x00007FFB6BA85000-memory.dmp

Download