c10fd2b8adb1eb2dcc8e17c9db57f96bcac3e81eba6c940802e7f37ca6adf63f

Analysis

max time kernel
150s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 22:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_34c17324ba58264e361e70395fe0c3af_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260708-2hctxsh18p
SHA256 c10fd2b8adb1eb2dcc8e17c9db57f96bcac3e81eba6c940802e7f37ca6adf63f
MD5 34c17324ba58264e361e70395fe0c3af
SHA1 a15b588b70d2da8debb900b91dd6954e39858f3f
SHA512 b9258c3a912cbbde96799f0fdb0a5589080585ef11662fb3d67c62dc4da87f0610c9d4f8f580001230b9937900e88de90bdf4f81df2c03568e516fd9784614ec
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJn:mh7c54FK70K7Nn
TLSH
T1AEB38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1680	sjqzyjd.exe
4024	sjqzyjd.exe
1088	sjqzyjd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\sjqzyjd.exe	sjqzyjd.exe
File created	C:\PROGRA~3\Mozilla\sjqzyjd.exe	2026-07-08_34c17324ba58264e361e70395fe0c3af_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
692	1680	WerFault.exe	88
1292	1088	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_34c17324ba58264e361e70395fe0c3af_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sjqzyjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sjqzyjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sjqzyjd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1680	sjqzyjd.exe
1680	sjqzyjd.exe
1088	sjqzyjd.exe
1088	sjqzyjd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	sjqzyjd.exe
Token: SeDebugPrivilege	1088	sjqzyjd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3492	1680	sjqzyjd.exe	51
PID 1088 wrote to memory of 3492	1088	sjqzyjd.exe	51

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3492
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_34c17324ba58264e361e70395fe0c3af_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-08_34c17324ba58264e361e70395fe0c3af_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3808

C:\PROGRA~3\Mozilla\sjqzyjd.exe
"C:\PROGRA~3\Mozilla\sjqzyjd.exe" -prrwkbh
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 528
  2⤵
  - Program crash
  PID:692

C:\PROGRA~3\Mozilla\sjqzyjd.exe
C:\PROGRA~3\Mozilla\sjqzyjd.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1680 -ip 1680
1⤵
PID:4092

C:\PROGRA~3\Mozilla\sjqzyjd.exe
"C:\PROGRA~3\Mozilla\sjqzyjd.exe" -prrwkbh
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 512
  2⤵
  - Program crash
  PID:1292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1088 -ip 1088
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sjqzyjd.exe

Path C:\ProgramData\Mozilla\sjqzyjd.exe
Size 106KB
SHA256 9f175fe9a2f311e173be408a063830a58f1c8adc62d68b4cfa81fcc5c446fc59
MD5 ca57959e8d53b55540cf536af976ef3d
SHA1 75e10542bd277d66bbe19d275e03387167e5cbb8
SHA512 77a44e9528354ec675b63b75e325e999836b62a3dcef8d93634d5f501c7be60ae87aea6e094f989c7494b47c859bc21c2616fe7671ac1d71c4cca1b4718430ef
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJU:mh7c54FK70K7NU
TLSH
T17AB38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sjqzyjd.exe

Path C:\ProgramData\Mozilla\sjqzyjd.exe
Size 106KB
SHA256 d025fc11d3b74269414e08f8f68f15b473d3fceaeafe0baee56ea701118af198
MD5 f0f1884a412399f667873e646573c997
SHA1 0d36322067242589d0965dec6ce9b2750c4c259a
SHA512 5f8dab236928ca7b1a64c3a435edce64858dbe9230630c5ae0b42b750bf620a0907beac2c519ad93357d8a73fc7b8035faded4b0b95d19343875f4dd80a8620e
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJq:mh7c54FK70K7Nq
TLSH
T191B38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3492-4-0x0000000002900000-0x000000000291C000-memory.dmp

Download

memory/4024-6-0x0000000000B30000-0x0000000000B8F000-memory.dmp

Download