0fc2f9df50e4bb7f3119a578cc913afb2fa5ea25eebcc235901daafaf0f374c0

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_697345612962d87a7a3ea2b9cfe1b525_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260705-tkvthsdx5s
SHA256 0fc2f9df50e4bb7f3119a578cc913afb2fa5ea25eebcc235901daafaf0f374c0
MD5 697345612962d87a7a3ea2b9cfe1b525
SHA1 7cf218f69ffe53e7ffc85186c39824f6aa234325
SHA512 6fb9d6620603e9e2224d739caf8220c65360db3253b910839b9a309db2d2fd492187fd10dcceaec96498c9e14635eeb219da2b4562b39e295b98e6df176de231
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYro:kIAFGBIaEwK70K7
TLSH
T153B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDD702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5776	rnsjkra.exe
3340	rnsjkra.exe
2424	rnsjkra.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\rnsjkra.exe	2026-07-05_697345612962d87a7a3ea2b9cfe1b525_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\rnsjkra.exe	rnsjkra.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3892	5776	WerFault.exe	89
1188	2424	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_697345612962d87a7a3ea2b9cfe1b525_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rnsjkra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rnsjkra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rnsjkra.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5776	rnsjkra.exe
5776	rnsjkra.exe
2424	rnsjkra.exe
2424	rnsjkra.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5776	rnsjkra.exe
Token: SeDebugPrivilege	2424	rnsjkra.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 3580	5776	rnsjkra.exe	54
PID 2424 wrote to memory of 3580	2424	rnsjkra.exe	54

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3580
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_697345612962d87a7a3ea2b9cfe1b525_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-05_697345612962d87a7a3ea2b9cfe1b525_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:6008

C:\PROGRA~3\Mozilla\rnsjkra.exe
"C:\PROGRA~3\Mozilla\rnsjkra.exe" -audqkzc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5776 -s 528
  2⤵
  - Program crash
  PID:3892

C:\PROGRA~3\Mozilla\rnsjkra.exe
C:\PROGRA~3\Mozilla\rnsjkra.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5776 -ip 5776
1⤵
PID:2316

C:\PROGRA~3\Mozilla\rnsjkra.exe
"C:\PROGRA~3\Mozilla\rnsjkra.exe" -audqkzc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 500
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2424 -ip 2424
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rnsjkra.exe

Path C:\ProgramData\Mozilla\rnsjkra.exe
Size 107KB
SHA256 8fc74c49935d1e420fd8a569638848457bdfc40feac083ca88dd38c5a7d4670e
MD5 8db81244c4f715a0bba36505b9c6d3e6
SHA1 818810443a852eb32b0bcca1f37b19ba51b959fe
SHA512 d64f0702edf2a35c6393cbc94d55052db165a0b140921c14c576418a829f59a606b8b1e41c3f89d8815bd012911a8765b71b5f3079233e2fbe28757ca845f01d
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrok:kIAFGBIaEwK70K7o
TLSH
T135B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDD702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rnsjkra.exe

Path C:\ProgramData\Mozilla\rnsjkra.exe
Size 107KB
SHA256 bc530151d0c1def4c69378af0fef85f9c3ce87b923d4c608d79fe51d41a69294
MD5 cb2cf9abc6dfbf76b80723e9bf8f9d79
SHA1 688c0ce958e716df037658a323876255dba87421
SHA512 d20d907f4ce2981e52f86412bd225dffcaa6e6d6126f2574a0f20cd788292e2dc22aa61f550dff7b8a1c3b908487505371d9dc2e027d591e15e2e239510f9e8a
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroB:kIAFGBIaEwK70K7t
TLSH
T14CB38E41F3D0DD66F05C253184A746B30AB5ED1297B125AB17883BAFDD702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3340-6-0x0000000000800000-0x000000000085EF1C-memory.dmp

Download

memory/3580-4-0x0000000007640000-0x000000000765C000-memory.dmp

Download