530c3c2951a20a4de5076d9be6374007644a20972dd4fae583d43054de5de63f

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_163cf6d8c00eea789e62079cb7b5d794_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260705-vvf9jsas2k
SHA256 530c3c2951a20a4de5076d9be6374007644a20972dd4fae583d43054de5de63f
MD5 163cf6d8c00eea789e62079cb7b5d794
SHA1 5a8027ef234ef2fdab7b0117dbffc3e9cf1595ad
SHA512 9aad9c5ef48cd09f6488b4fcb098b47a45990606fe0e1cc8be0ce5632537d960fdd9b0262adc881bd771e77822272c64709cd49659fcee6532c027b83248acea
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYro8:kIAFGBIaEwK70K7Q
TLSH
T183B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
6048	mlpybnj.exe
4984	mlpybnj.exe
6944	mlpybnj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\mlpybnj.exe	2026-07-05_163cf6d8c00eea789e62079cb7b5d794_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\mlpybnj.exe	mlpybnj.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6952	6048	WerFault.exe	89
6700	6944	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlpybnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlpybnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mlpybnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_163cf6d8c00eea789e62079cb7b5d794_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6048	mlpybnj.exe
6048	mlpybnj.exe
6944	mlpybnj.exe
6944	mlpybnj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	mlpybnj.exe
Token: SeDebugPrivilege	6944	mlpybnj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 3816	6048	mlpybnj.exe	58
PID 6944 wrote to memory of 3816	6944	mlpybnj.exe	58

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3816
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_163cf6d8c00eea789e62079cb7b5d794_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-05_163cf6d8c00eea789e62079cb7b5d794_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3552

C:\PROGRA~3\Mozilla\mlpybnj.exe
"C:\PROGRA~3\Mozilla\mlpybnj.exe" -uuaivki
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 528
  2⤵
  - Program crash
  PID:6952

C:\PROGRA~3\Mozilla\mlpybnj.exe
C:\PROGRA~3\Mozilla\mlpybnj.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6048 -ip 6048
1⤵
PID:1664

C:\PROGRA~3\Mozilla\mlpybnj.exe
"C:\PROGRA~3\Mozilla\mlpybnj.exe" -uuaivki
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 508
  2⤵
  - Program crash
  PID:6700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6944 -ip 6944
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mlpybnj.exe

Path C:\ProgramData\Mozilla\mlpybnj.exe
Size 107KB
SHA256 8a838d5b6491ddfdac2106b4db9f23eccfd6d4a7a35cd25ad4447719dcc39413
MD5 ca873562424eddf52222b129af97365d
SHA1 a5a147dbeb09fa90676fe35a16df0435bb620a6b
SHA512 4b81992f5d61c63bc0570224dbc7ef37773db4998fee67673dd2b4a28e70c4abf2cdb57200e3a28b9db5c8ba2f461c8cad667c20146d60991dc4e55931eb8645
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrou:kIAFGBIaEwK70K7C
TLSH
T1C5B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mlpybnj.exe

Path C:\ProgramData\Mozilla\mlpybnj.exe
Size 107KB
SHA256 f447b0f942e4ba84d648e3382d1b16beaa144bc86107296b32186f90f59df02b
MD5 5e689a3bf10017eaaaa014f6796f71a9
SHA1 be2b2677b35c8b95f54fc75a8874b25f51d8f894
SHA512 ceff1832f91d6dff5d7acbe80d7553a64522ced0147fafe1ac32bde1738b1f62cd6dd64ac5b772b2c1affa2d0b29705d6060bc975ea2c5065c65cb8ee56c436c
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroQ:kIAFGBIaEwK70K7U
TLSH
T119B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3816-4-0x0000000002D40000-0x0000000002D5C000-memory.dmp

Download

memory/4984-6-0x0000000000570000-0x00000000005CEF1C-memory.dmp

Download