a8eb54c3c6f84538be6e3b90727b0b93e1a336489614388b4bc65ea30a6b979c

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe
Size 15.3MB
Sample260708-e6grfsbw5m
SHA256 a8eb54c3c6f84538be6e3b90727b0b93e1a336489614388b4bc65ea30a6b979c
MD5 6c035aa3b385eb359fc26efa60738b63
SHA1 80d67e13e6a683d482242ffe2613f45a5bfb1294
SHA512 31859a597c02344e21c1cc28b915a4fbf3571468e8bf7136bc99741821e054d9cf42689395f950a2a1f29165a4d72442a1e1023599bdf91baa49e6677156d880
SSDEEP 393216:qnx6HLDr5xlHu4PD5yVF/mQuDhiKv1OrplrHNW9D1F2:o6HLB/HuAm/mQuli+SWT0
TLSH
T180F633301190A326FDF2463159BC8272C5A97EF2973084DBF3B439899AF6DD0997172E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4520	Autotrasportatori2trimestre2026.exe

Loads dropped DLL 1 IoCs

pid	Process
1980	javaw.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Autotrasportatori2trimestre2026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3700	wmic.exe
3700	wmic.exe
3700	wmic.exe
3700	wmic.exe
5752	wmic.exe
5752	wmic.exe
5752	wmic.exe
5752	wmic.exe
2596	wmic.exe
2596	wmic.exe
2596	wmic.exe
2596	wmic.exe
5960	wmic.exe
5960	wmic.exe
5960	wmic.exe
5960	wmic.exe
2724	wmic.exe
2724	wmic.exe
2724	wmic.exe
2724	wmic.exe
1592	wmic.exe
1592	wmic.exe
1592	wmic.exe
1592	wmic.exe
3840	wmic.exe
3840	wmic.exe
3840	wmic.exe
3840	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3700	wmic.exe
Token: SeSecurityPrivilege	3700	wmic.exe
Token: SeTakeOwnershipPrivilege	3700	wmic.exe
Token: SeLoadDriverPrivilege	3700	wmic.exe
Token: SeSystemProfilePrivilege	3700	wmic.exe
Token: SeSystemtimePrivilege	3700	wmic.exe
Token: SeProfSingleProcessPrivilege	3700	wmic.exe
Token: SeIncBasePriorityPrivilege	3700	wmic.exe
Token: SeCreatePagefilePrivilege	3700	wmic.exe
Token: SeBackupPrivilege	3700	wmic.exe
Token: SeRestorePrivilege	3700	wmic.exe
Token: SeShutdownPrivilege	3700	wmic.exe
Token: SeDebugPrivilege	3700	wmic.exe
Token: SeSystemEnvironmentPrivilege	3700	wmic.exe
Token: SeRemoteShutdownPrivilege	3700	wmic.exe
Token: SeUndockPrivilege	3700	wmic.exe
Token: SeManageVolumePrivilege	3700	wmic.exe
Token: 33	3700	wmic.exe
Token: 34	3700	wmic.exe
Token: 35	3700	wmic.exe
Token: 36	3700	wmic.exe
Token: SeIncreaseQuotaPrivilege	3700	wmic.exe
Token: SeSecurityPrivilege	3700	wmic.exe
Token: SeTakeOwnershipPrivilege	3700	wmic.exe
Token: SeLoadDriverPrivilege	3700	wmic.exe
Token: SeSystemProfilePrivilege	3700	wmic.exe
Token: SeSystemtimePrivilege	3700	wmic.exe
Token: SeProfSingleProcessPrivilege	3700	wmic.exe
Token: SeIncBasePriorityPrivilege	3700	wmic.exe
Token: SeCreatePagefilePrivilege	3700	wmic.exe
Token: SeBackupPrivilege	3700	wmic.exe
Token: SeRestorePrivilege	3700	wmic.exe
Token: SeShutdownPrivilege	3700	wmic.exe
Token: SeDebugPrivilege	3700	wmic.exe
Token: SeSystemEnvironmentPrivilege	3700	wmic.exe
Token: SeRemoteShutdownPrivilege	3700	wmic.exe
Token: SeUndockPrivilege	3700	wmic.exe
Token: SeManageVolumePrivilege	3700	wmic.exe
Token: 33	3700	wmic.exe
Token: 34	3700	wmic.exe
Token: 35	3700	wmic.exe
Token: 36	3700	wmic.exe
Token: SeIncreaseQuotaPrivilege	5752	wmic.exe
Token: SeSecurityPrivilege	5752	wmic.exe
Token: SeTakeOwnershipPrivilege	5752	wmic.exe
Token: SeLoadDriverPrivilege	5752	wmic.exe
Token: SeSystemProfilePrivilege	5752	wmic.exe
Token: SeSystemtimePrivilege	5752	wmic.exe
Token: SeProfSingleProcessPrivilege	5752	wmic.exe
Token: SeIncBasePriorityPrivilege	5752	wmic.exe
Token: SeCreatePagefilePrivilege	5752	wmic.exe
Token: SeBackupPrivilege	5752	wmic.exe
Token: SeRestorePrivilege	5752	wmic.exe
Token: SeShutdownPrivilege	5752	wmic.exe
Token: SeDebugPrivilege	5752	wmic.exe
Token: SeSystemEnvironmentPrivilege	5752	wmic.exe
Token: SeRemoteShutdownPrivilege	5752	wmic.exe
Token: SeUndockPrivilege	5752	wmic.exe
Token: SeManageVolumePrivilege	5752	wmic.exe
Token: 33	5752	wmic.exe
Token: 34	5752	wmic.exe
Token: 35	5752	wmic.exe
Token: 36	5752	wmic.exe
Token: SeIncreaseQuotaPrivilege	5752	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1980	javaw.exe
1980	javaw.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4520	4624	2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe	88
PID 4520 wrote to memory of 1980	4520	Autotrasportatori2trimestre2026.exe	89
PID 1980 wrote to memory of 3700	1980	javaw.exe	90
PID 1980 wrote to memory of 5752	1980	javaw.exe	93
PID 1980 wrote to memory of 2596	1980	javaw.exe	95
PID 1980 wrote to memory of 5960	1980	javaw.exe	97
PID 1980 wrote to memory of 2724	1980	javaw.exe	99
PID 1980 wrote to memory of 1592	1980	javaw.exe	101
PID 1980 wrote to memory of 3840	1980	javaw.exe	103
PID 1980 wrote to memory of 5764	1980	javaw.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5764	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6c035aa3b385eb359fc26efa60738b63_amadey_darkgate_elex_hawkeye_remcos_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\Autotrasportatori2trimestre2026.exe
  C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\Autotrasportatori2trimestre2026.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms16777216 -Xmx50331648 -classpath "C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData\IAClasses.zip;C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\InstallerData\Execute.zip;C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\InstallerData\Resource1.zip;C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData;C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\InstallerData;" com.zerog.lax.LAX "C:/Users/Admin/AppData/Local/Temp/I1783485187/Windows/Autotrasportatori2trimestre2026.lax" "C:/Users/Admin/AppData/Local/Temp/lax7555.tmp"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3700
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5752
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2596
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5960
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2724
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get name
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1592
  - - C:\Windows\System32\Wbem\wmic.exe
      wmic os get version
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3840
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h "C:\Users\Admin\InstallAnywhere"
      4⤵
      Views/modifies file attributes
      PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Execute.zip

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData\Execute.zip
Size 1.8MB
SHA256 9c6055850686b4df1da7e703be09859437060487da532d7d0d1af411dbcdbcad
MD5 31131d01a4580c5630dfb37e78f9d281
SHA1 0768c1d9c72235d8b2adcc0b8f99df49c536418d
SHA512 02c6f54e1bfc6d8fe471f79f3e6bda031e7e7ae2f3dff9663143cc6e3ebdd60ea6127e8610418f769025ff22c9979737779735e0d0447c1352c9c91e1ba2885c
SSDEEP 24576:tmL80R6ivkZeqNyBNDu7eknCw0+X6ZLmOGJuyqtLTmHePkPDMQHOaGi9M:wpRXfaeS0+Kpmbuttnm+PkPDMQHOaGie
TLSH
T13A953935AB88B834FDE24276896E24B5DD6A6CB4033060D1F3FBB649A6F6C40155E31F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IAClasses.zip

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\InstallerData\IAClasses.zip
Size 4.8MB
SHA256 a5ce324fcc0e7b7f5943b149c38a4fbc4df9c103df8d42bbf8ff53db02691d28
MD5 add71c59e921cd65b60d5f67dcbf0b0a
SHA1 deb3f994049be4abbe1bb1902da25d0a22bda178
SHA512 8ebb7fbe747c948ebdd1c76779386bb669dd9a4739b6d7cb9d0f9c253d310222b140636daeb694d3e8723860dd21efa4539b8f326ffe399604d2db8cd423c5cb
SSDEEP 98304:iIGsbjMWQmbQh6oOGLSfjxstIiRyqLuN4E1jnoSQwSYntMuk:ixsbjQh6oOGLd2iRyqiNh1SwXyp
TLSH
T11536E1129688233AFA37527E80524573E81ABAECD386F0257CE598C1C536EDE1747B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autotrasportatori2trimestre2026.exe

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\Autotrasportatori2trimestre2026.exe
Size 546KB
SHA256 5a8d71a0e844e153a34985142ba798a1e1ea99dd79ac944c7c5f570d19e4f762
MD5 40e72bb55d9e6e21c77a421da824ec3a
SHA1 c9e9fadef1fdc8db83cc207bebd877b19573fe09
SHA512 d814c1d2341c923207d668713c152acb60d0736f6db04a85d0e3215ebc52e90432b97c3c3f47b76ae4f8267ac3f7576bdc1af769774b97dacf1612d22eb95092
SSDEEP 6144:gD8BWZZ4tzU/Oeknze8SxVp+0XKrCuVGsJL2LgVUL9Lm:gD8sZ+toWeknz2xC0XwXrLFUZLm
TLSH
T10AC4F73026919132FEF306355A7C9232CAA97CF29B3186CBE3B47549D9F2D419D6072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Autotrasportatori2trimestre2026.lax

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\Autotrasportatori2trimestre2026.lax
Size 1KB
SHA256 e7369f05b9d3d679943ec378c2832eff8276abdaf69b37e33d4a71f67f0e02b9
MD5 c3431c10e9b596b02bb3e92208d9c1ee
SHA1 4cad9cbdfe1d425ed154f22886e164effa53424e
SHA512 29d9a92fc21e0b21b532316686b91a1804e1ef93a382a7f75e3959f93ae69823a1db270752dfc2ec2620f6d82dc56af656f78ec22174e10f6be315b81a1a0e86
TLSH
T16421490E67C302E5320602AE26FA93B8252223F855E4F434B9FF560639E66CD7193D1E
MD5 SHA1 SHA512 TLSH

Submit Download

jvmspecs.properties

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\jvmspecs\jvmspecs.properties
Size 448B
SHA256 159b6e2e06fe0875d581402f2fbe348b6eed1c0b8eb802129843cbeb7ed5f5fa
MD5 caa5fcd1cb5146fc9985dd562d54c3ef
SHA1 9c7f52c0dab94b7b7684d4fabc8dc01970bb6011
SHA512 42f0d82908af43db6ba8c96e4f41c14824bf97b1e72fd7e73c0d9adddc8b4bb49e28259cde84a7328e01d695a892b025941ff0295e8a5d30d8c0e24a32cdb75a
TLSH
T1DEF0306A6193C709A9FC5C5C70A917F0BD629BFA899C41F240783905907BBDA64A34C7
MD5 SHA1 SHA512 TLSH

Submit Download

iawin64_x64.dll

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\Windows\resource\iawin64_x64.dll
Size 142KB
SHA256 94e116d5714e9bd6c8989675d5c9405192f8d57149a998ccb5c3c2b6d1572f84
MD5 290cf550cbf94339470d665267a50790
SHA1 1449c90d1f770effcbe3170be255a1b99374a685
SHA512 7db0b95c0361240ec2d7def897217b9d1721cc180c92eddfa2e96dac95a21ce64701c3ef041d216e407a7f98310c3870fa5ac843ab4f3bad2d1b029c1c7f4a73
SSDEEP 3072:eW62RLoGD2d0OYsJWK3dFSoTDm6MpgIXAQ3YD+baEo27S3STwWJBE8aODp:V9D26ns8KOoTa6EgIXSDnwEdup
TLSH
T197E3494B33A404BBE1A38639C9A34A16D7727C6107B19BCF43A4439A5F633E15E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sea_loc

Path C:\Users\Admin\AppData\Local\Temp\I1783485187\sea_loc
Size 132B
SHA256 80bbc0848338f455c306aa1f64a194b9d74d0124a2a16653549012013565493b
MD5 c6c50e1b7151f1d6b5a691e3046d75dc
SHA1 c6946ca80a5094e923f04d9e19e261eecce50fe6
SHA512 59516b66e58cdcd2df2f62f9e7f980674b87a8ab46c8b6faf2bb212cdc635429e438115958614d41a2d42eaceae409e05ef1e7c93d5123fb9dc7a7eead8657cc
TLSH
T189C02B19036FDE130024F027C3F13488C0504D1F13761B103324C10C00C0426F1CA243
MD5 SHA1 SHA512 TLSH

Submit Download

lax7555.tmp

Path C:\Users\Admin\AppData\Local\Temp\lax7555.tmp
Size 6KB
SHA256 0d1018e4a5b3cb5b6e0b7a89dfd838c81e2c064ff7ad1e28e53de6754b147ff9
MD5 d0348a1f25bd67876d2bcfd38791a252
SHA1 3e1bfeb6ffd033927a722714ad6636131aa2f630
SHA512 53ad6ffe8b39496a9a31aad0a37b7f41dc8961930838f2516ab445d346be41b4bab615a0fd48c2862b50cebd8bf82d40a34045da2dc68558d6baf52f2b680b79
SSDEEP 96:ca/zlTpD5qrBfKHTi8Im3ZTkuupIHrzLDHrzRHrzme:ciTpFqrBfKHTtT5Xpme
TLSH
T11AE19962B5A1E5B0B4422B15A2C95F2C92B4F41D3BD4C2E2534C9689F9F0F19872FCF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1980-86-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-97-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-68-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-61-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-50-0x000001D6CD490000-0x000001D6CD700000-memory.dmp

Download

memory/1980-89-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-92-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-70-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-106-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-109-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-115-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-117-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-119-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-133-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download

memory/1980-134-0x000001D6CD490000-0x000001D6CD700000-memory.dmp

Download

memory/1980-189-0x000001D6CD420000-0x000001D6CD421000-memory.dmp

Download