Analysis
- max time kernel
122s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 19:08
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe
- Size 4.6MB
- Sample260704-xtd4xacv2w
- SHA256 1c9da8a43fa82c9bd5f17097ec02c19a11da9ed1328244e1dfeed1c8c2419e3e
- MD5 3fd9570e03a89625ea8d28044ba8c64a
- SHA1 7054b6804d25fda96388bc1b9e37f571ea794e64
- SHA512 139ceecf007a511849779156973b516f67c2d4b8516967d0cf60dfc0c927facaf8393bf3e044de51994baba6ec315d78f0292bf20dd17bfd81e70ee6952f149e
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0Ax:BO2pIDQDCs1Shv7StPjo0jo
- TLSH T11B264A1DFEE44E65E0B39175C9A2935DEA323C511B3086CF1280B669EE32FD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1040-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b8be-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000016d03-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019f37-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1040-1289-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1484-1302-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a21-1451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a33-1450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000066a5-1805.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1484 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1040 2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe 1484 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_3fd9570e03a89625ea8d28044ba8c64a_amadey_darkgate_elex_icedid_smoke-loader_stealc_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1040
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1484
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.6MB
- SHA256 1c9da8a43fa82c9bd5f17097ec02c19a11da9ed1328244e1dfeed1c8c2419e3e
- MD5 3fd9570e03a89625ea8d28044ba8c64a
- SHA1 7054b6804d25fda96388bc1b9e37f571ea794e64
- SHA512 139ceecf007a511849779156973b516f67c2d4b8516967d0cf60dfc0c927facaf8393bf3e044de51994baba6ec315d78f0292bf20dd17bfd81e70ee6952f149e
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0Ax:BO2pIDQDCs1Shv7StPjo0jo
- TLSH T11B264A1DFEE44E65E0B39175C9A2935DEA323C511B3086CF1280B669EE32FD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- Size 5.0MB
- SHA256 d399146b74f94951e0de61a634a8c2ad0b3889f3ff2d1775bf3905108a6c34a1
- MD5 86c94571a9a2c46033ca1855815e3e08
- SHA1 2f0dd04409985ebd42ab1d64a20d668f3c384af4
- SHA512 5e64809d0341929c70b41007678cdd2ada9c2faf51bf0065aa5c8285cd2652717dc3c0c9c94a859c6df48f9b7b7cbcb9a9158432ed13fb0eda4e07545e830de5
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0AG:BO2pIDQDCs1Shv7StPjo0jo+KK
- TLSH T156364A0DFFA44E65E0B39175C9A2935DEA723C511B3086CF1280B66DEE32FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$
- Size 5.0MB
- SHA256 b466294be853656c7861d934e8913a41fddd005448430ba7679ada775aebbff4
- MD5 4e7785cd0bf14c1d533cf57b73b8d7d5
- SHA1 3eb96967f396c7439da83b25b6646b02e36bf18f
- SHA512 a5d32e183a628595dd4735194eb23e817a5f2a29156baae90db411d890391d85b4bb1cf76f4a90e743957d2729058dab7bc640983054ab23310ee9ad730eba97
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0Ab:BO2pIDQDCs1Shv7StPjo0joh
- TLSH T15D365B1DFFA44E65E0B39175C9A5936EEA323C510B3086CF1280B66DDE32FD19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 4.7MB
- SHA256 88bdf4c88a340b2dcc27d46fb47e4aa9e1e402263723e580720d94d634391cb6
- MD5 1841fbc6d27416c228e2bbbd37ecba1e
- SHA1 e25bbd70c2c130c21919a1e89ffb6ccebf550d19
- SHA512 d5e06c67d2c5b10bb7f5cb1bf80a9a9de181109d6fbada301f1e489969d34c979f6a15de5ae81ee4239340b86d188eec62e105f75f56cab6745674625434d535
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0AT:BO2pIDQDCs1Shv7StPjo0jokMqlu
- TLSH T128364A1DFEE44E65E0B39175C9A2935DEA323C511B3086CF1280B669EE32FD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.2MB
- SHA256 d2df89d0bce5b46533b38ae3a683e9c73caa1d209c9f4c0bb22cb241a481771f
- MD5 3d6eb9e7daa33fe916c9085bea0b062b
- SHA1 7b939ee35b309bb948547656bd04ce079e424f1d
- SHA512 82d28c319600bedb3be1a41ca11bb70b4e3a7115ca4e5ec1813f8682c14df2687ec64ceadd575c62f4b1976a0b5e87e637aa255565fb9c08367c7bcb309ac597
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0AP:BO2pIDQDCs1Shv7StPjo0jo0jo
- TLSH T185464A1DFEA44E65E0739175C9A2935EEA323C510B3086CF1281B669EE33FD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.7MB
- SHA256 9469324effc197d1e10ec7140184e6cb77e6dedfc4b548b218ffda974abcf759
- MD5 0c2a837c827452148f68428fc77bd004
- SHA1 1bc1330664a36e91951f5ba3da887e2bdaee98ea
- SHA512 87c18102db29e9b537faa81d285aa2e55cb716e2e7199d245fca1d421fbbcd07b9611d02a9afa815ddb40a061b28aa2f048d55eb48f7e648f50bcf539b9c5738
- SSDEEP 49152:haPcOpwxX0TYS/4MnYYJ2ZhqSGLHkJEMhHF+3j5D78OBUShKPgssSt2gKAPji0AJ:BO2pIDQDCs1Shv7StPjo0joX
- TLSH T176364B1DFEE44E65E0B39175C9A2935EEA323C511B3086CF1280B669DE32FD19936732
- MD5 SHA1 SHA512 SSDEEP TLSH