a8eb54c3c6f84538be6e3b90727b0b93e1a336489614388b4bc65ea30a6b979c

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe
Size 15.3MB
Sample260708-e6grfsbw5m
SHA256 a8eb54c3c6f84538be6e3b90727b0b93e1a336489614388b4bc65ea30a6b979c
MD5 6c035aa3b385eb359fc26efa60738b63
SHA1 80d67e13e6a683d482242ffe2613f45a5bfb1294
SHA512 31859a597c02344e21c1cc28b915a4fbf3571468e8bf7136bc99741821e054d9cf42689395f950a2a1f29165a4d72442a1e1023599bdf91baa49e6677156d880
SSDEEP 393216:qnx6HLDr5xlHu4PD5yVF/mQuDhiKv1OrplrHNW9D1F2:o6HLB/HuAm/mQuli+SWT0
TLSH
T180F633301190A326FDF2463159BC8272C5A97EF2973084DBF3B439899AF6DD0997172E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
816	Autotrasportatori2trimestre2026.exe

Loads dropped DLL 1 IoCs

pid	Process
3512	javaw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autotrasportatori2trimestre2026.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2320	wmic.exe
Token: SeSecurityPrivilege	2320	wmic.exe
Token: SeTakeOwnershipPrivilege	2320	wmic.exe
Token: SeLoadDriverPrivilege	2320	wmic.exe
Token: SeSystemProfilePrivilege	2320	wmic.exe
Token: SeSystemtimePrivilege	2320	wmic.exe
Token: SeProfSingleProcessPrivilege	2320	wmic.exe
Token: SeIncBasePriorityPrivilege	2320	wmic.exe
Token: SeCreatePagefilePrivilege	2320	wmic.exe
Token: SeBackupPrivilege	2320	wmic.exe
Token: SeRestorePrivilege	2320	wmic.exe
Token: SeShutdownPrivilege	2320	wmic.exe
Token: SeDebugPrivilege	2320	wmic.exe
Token: SeSystemEnvironmentPrivilege	2320	wmic.exe
Token: SeRemoteShutdownPrivilege	2320	wmic.exe
Token: SeUndockPrivilege	2320	wmic.exe
Token: SeManageVolumePrivilege	2320	wmic.exe
Token: 33	2320	wmic.exe
Token: 34	2320	wmic.exe
Token: 35	2320	wmic.exe
Token: 36	2320	wmic.exe
Token: SeIncreaseQuotaPrivilege	2320	wmic.exe
Token: SeSecurityPrivilege	2320	wmic.exe
Token: SeTakeOwnershipPrivilege	2320	wmic.exe
Token: SeLoadDriverPrivilege	2320	wmic.exe
Token: SeSystemProfilePrivilege	2320	wmic.exe
Token: SeSystemtimePrivilege	2320	wmic.exe
Token: SeProfSingleProcessPrivilege	2320	wmic.exe
Token: SeIncBasePriorityPrivilege	2320	wmic.exe
Token: SeCreatePagefilePrivilege	2320	wmic.exe
Token: SeBackupPrivilege	2320	wmic.exe
Token: SeRestorePrivilege	2320	wmic.exe
Token: SeShutdownPrivilege	2320	wmic.exe
Token: SeDebugPrivilege	2320	wmic.exe
Token: SeSystemEnvironmentPrivilege	2320	wmic.exe
Token: SeRemoteShutdownPrivilege	2320	wmic.exe
Token: SeUndockPrivilege	2320	wmic.exe
Token: SeManageVolumePrivilege	2320	wmic.exe
Token: 33	2320	wmic.exe
Token: 34	2320	wmic.exe
Token: 35	2320	wmic.exe
Token: 36	2320	wmic.exe
Token: SeIncreaseQuotaPrivilege	4804	wmic.exe
Token: SeSecurityPrivilege	4804	wmic.exe
Token: SeTakeOwnershipPrivilege	4804	wmic.exe
Token: SeLoadDriverPrivilege	4804	wmic.exe
Token: SeSystemProfilePrivilege	4804	wmic.exe
Token: SeSystemtimePrivilege	4804	wmic.exe
Token: SeProfSingleProcessPrivilege	4804	wmic.exe
Token: SeIncBasePriorityPrivilege	4804	wmic.exe
Token: SeCreatePagefilePrivilege	4804	wmic.exe
Token: SeBackupPrivilege	4804	wmic.exe
Token: SeRestorePrivilege	4804	wmic.exe
Token: SeShutdownPrivilege	4804	wmic.exe
Token: SeDebugPrivilege	4804	wmic.exe
Token: SeSystemEnvironmentPrivilege	4804	wmic.exe
Token: SeRemoteShutdownPrivilege	4804	wmic.exe
Token: SeUndockPrivilege	4804	wmic.exe
Token: SeManageVolumePrivilege	4804	wmic.exe
Token: 33	4804	wmic.exe
Token: 34	4804	wmic.exe
Token: 35	4804	wmic.exe
Token: 36	4804	wmic.exe
Token: SeIncreaseQuotaPrivilege	4804	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3512	javaw.exe
3512	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 816	4352	2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe	85
PID 816 wrote to memory of 3512	816	Autotrasportatori2trimestre2026.exe	86
PID 3512 wrote to memory of 2320	3512	javaw.exe	87
PID 3512 wrote to memory of 4804	3512	javaw.exe	90
PID 3512 wrote to memory of 1708	3512	javaw.exe	92
PID 3512 wrote to memory of 436	3512	javaw.exe	94
PID 3512 wrote to memory of 1064	3512	javaw.exe	96
PID 3512 wrote to memory of 4128	3512	javaw.exe	98
PID 3512 wrote to memory of 4556	3512	javaw.exe	100
PID 3512 wrote to memory of 2216	3512	javaw.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2216	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\Autotrasportatori2trimestre2026.exe
  C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\Autotrasportatori2trimestre2026.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1783485184/Windows/Autotrasportatori2trimestre2026.lax" "C:/Users/Admin/AppData/Local/Temp/lax1827.tmp"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2320
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4804
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      PID:1708
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      PID:436
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      PID:1064
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      PID:4128
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get version
      4⤵
      PID:4556
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\InstallAnywhere"
      4⤵
      Views/modifies file attributes
      PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Execute.zip

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData\Execute.zip
Size 1.8MB
SHA256 9c6055850686b4df1da7e703be09859437060487da532d7d0d1af411dbcdbcad
MD5 31131d01a4580c5630dfb37e78f9d281
SHA1 0768c1d9c72235d8b2adcc0b8f99df49c536418d
SHA512 02c6f54e1bfc6d8fe471f79f3e6bda031e7e7ae2f3dff9663143cc6e3ebdd60ea6127e8610418f769025ff22c9979737779735e0d0447c1352c9c91e1ba2885c
SSDEEP 24576:tmL80R6ivkZeqNyBNDu7eknCw0+X6ZLmOGJuyqtLTmHePkPDMQHOaGi9M:wpRXfaeS0+Kpmbuttnm+PkPDMQHOaGie
TLSH
T13A953935AB88B834FDE24276896E24B5DD6A6CB4033060D1F3FBB649A6F6C40155E31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IAClasses.zip

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\InstallerData\IAClasses.zip
Size 4.8MB
SHA256 a5ce324fcc0e7b7f5943b149c38a4fbc4df9c103df8d42bbf8ff53db02691d28
MD5 add71c59e921cd65b60d5f67dcbf0b0a
SHA1 deb3f994049be4abbe1bb1902da25d0a22bda178
SHA512 8ebb7fbe747c948ebdd1c76779386bb669dd9a4739b6d7cb9d0f9c253d310222b140636daeb694d3e8723860dd21efa4539b8f326ffe399604d2db8cd423c5cb
SSDEEP 98304:iIGsbjMWQmbQh6oOGLSfjxstIiRyqLuN4E1jnoSQwSYntMuk:ixsbjQh6oOGLd2iRyqiNh1SwXyp
TLSH
T11536E1129688233AFA37527E80524573E81ABAECD386F0257CE598C1C536EDE1747B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autotrasportatori2trimestre2026.exe

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\Autotrasportatori2trimestre2026.exe
Size 546KB
SHA256 5a8d71a0e844e153a34985142ba798a1e1ea99dd79ac944c7c5f570d19e4f762
MD5 40e72bb55d9e6e21c77a421da824ec3a
SHA1 c9e9fadef1fdc8db83cc207bebd877b19573fe09
SHA512 d814c1d2341c923207d668713c152acb60d0736f6db04a85d0e3215ebc52e90432b97c3c3f47b76ae4f8267ac3f7576bdc1af769774b97dacf1612d22eb95092
SSDEEP 6144:gD8BWZZ4tzU/Oeknze8SxVp+0XKrCuVGsJL2LgVUL9Lm:gD8sZ+toWeknz2xC0XwXrLFUZLm
TLSH
T10AC4F73026919132FEF306355A7C9232CAA97CF29B3186CBE3B47549D9F2D419D6072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autotrasportatori2trimestre2026.lax

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\Autotrasportatori2trimestre2026.lax
Size 1KB
SHA256 e7369f05b9d3d679943ec378c2832eff8276abdaf69b37e33d4a71f67f0e02b9
MD5 c3431c10e9b596b02bb3e92208d9c1ee
SHA1 4cad9cbdfe1d425ed154f22886e164effa53424e
SHA512 29d9a92fc21e0b21b532316686b91a1804e1ef93a382a7f75e3959f93ae69823a1db270752dfc2ec2620f6d82dc56af656f78ec22174e10f6be315b81a1a0e86
TLSH
T16421490E67C302E5320602AE26FA93B8252223F855E4F434B9FF560639E66CD7193D1E
MD5 SHA1 SHA512 TLSH

Submit Download

jvmspecs.properties

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\jvmspecs\jvmspecs.properties
Size 448B
SHA256 159b6e2e06fe0875d581402f2fbe348b6eed1c0b8eb802129843cbeb7ed5f5fa
MD5 caa5fcd1cb5146fc9985dd562d54c3ef
SHA1 9c7f52c0dab94b7b7684d4fabc8dc01970bb6011
SHA512 42f0d82908af43db6ba8c96e4f41c14824bf97b1e72fd7e73c0d9adddc8b4bb49e28259cde84a7328e01d695a892b025941ff0295e8a5d30d8c0e24a32cdb75a
TLSH
T1DEF0306A6193C709A9FC5C5C70A917F0BD629BFA899C41F240783905907BBDA64A34C7
MD5 SHA1 SHA512 TLSH

Submit Download

iawin64_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\Windows\resource\iawin64_x64.dll
Size 142KB
SHA256 94e116d5714e9bd6c8989675d5c9405192f8d57149a998ccb5c3c2b6d1572f84
MD5 290cf550cbf94339470d665267a50790
SHA1 1449c90d1f770effcbe3170be255a1b99374a685
SHA512 7db0b95c0361240ec2d7def897217b9d1721cc180c92eddfa2e96dac95a21ce64701c3ef041d216e407a7f98310c3870fa5ac843ab4f3bad2d1b029c1c7f4a73
SSDEEP 3072:eW62RLoGD2d0OYsJWK3dFSoTDm6MpgIXAQ3YD+baEo27S3STwWJBE8aODp:V9D26ns8KOoTa6EgIXSDnwEdup
TLSH
T197E3494B33A404BBE1A38639C9A34A16D7727C6107B19BCF43A4439A5F633E15E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1783485184\sea_loc
Size 132B
SHA256 80bbc0848338f455c306aa1f64a194b9d74d0124a2a16653549012013565493b
MD5 c6c50e1b7151f1d6b5a691e3046d75dc
SHA1 c6946ca80a5094e923f04d9e19e261eecce50fe6
SHA512 59516b66e58cdcd2df2f62f9e7f980674b87a8ab46c8b6faf2bb212cdc635429e438115958614d41a2d42eaceae409e05ef1e7c93d5123fb9dc7a7eead8657cc
TLSH
T189C02B19036FDE130024F027C3F13488C0504D1F13761B103324C10C00C0426F1CA243
MD5 SHA1 SHA512 TLSH

Submit Download

lax1827.tmp

Path C:\Users\Admin\AppData\Local\Temp\lax1827.tmp
Size 6KB
SHA256 f5fa4727d16409cca3325ddfca5768edd3d7a28ff6f7c5eabedfcd5581f39b13
MD5 a4c4e2fd046ddfeb443e47462b967ad7
SHA1 b3895ac66917259cd2704ca3ed14b67f60e6c8bc
SHA512 ca43e0353105bface28430c1a630ff48eaccb1180363313d0c137e5b0cd9348c1fdf26bbb3a9daea0e3832724d8ecab2abb713a2de50cd985ca204e6d79cb0e4
SSDEEP 96:c1/zWdbU65qrBfKHTi8Im3ZTkuupIHrzLDHrzRHrz+wiZe:ciqrBfKHTtT5XpdiZe
TLSH
T1D1E16522B5A1D5B0B4422B1852DA2F2C92B4F41D7BE4C5E1534C9689F9F0F588B2FCF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3512-67-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-69-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-60-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-49-0x0000022FE4DF0000-0x0000022FE5060000-memory.dmp

Download

memory/3512-76-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-84-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-88-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-101-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-104-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-115-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

memory/3512-117-0x0000022FE4DF0000-0x0000022FE5060000-memory.dmp

Download

memory/3512-212-0x0000022FE4DD0000-0x0000022FE4DD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads