e297389f953adb3829f6e4e505f751fbf6d0d61edbf47d701213676b641c85c7

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_2910178ae5f8b9ec62234e38cbd150a1_amadey_darkgate_elex_smoke-loader_stealc_tofsee.exe
Size 264KB
Sample260711-ljpbcaft5m
SHA256 e297389f953adb3829f6e4e505f751fbf6d0d61edbf47d701213676b641c85c7
MD5 2910178ae5f8b9ec62234e38cbd150a1
SHA1 4b49d2b089d8b69d25d1b6f45654037608bc5189
SHA512 3f831eb4b8810a7428fbd2511a6bafee395df55235150f939e3c3d6d6b0e968b5d5a8d6cfcd7577cff876cf4c02b97d254ecef462dea388f42c14501f2469fde
SSDEEP 6144:qSW28OalabD8actvo8rSFZ7S7P/66H3y4W4oS+Edg1hS:CZEfc/rSvu7P/6604oSlohS
TLSH
T1E2447C303A849076CCB255359DF8E77A286D7F711B7491CBA3943B7E2A702E1973831A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1916-0-0x0000000000F70000-0x0000000000FB5000-memory.dmp	UPX
behavioral2/memory/1916-36-0x0000000000F70000-0x0000000000FB5000-memory.dmp	UPX

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1916-0-0x0000000000F70000-0x0000000000FB5000-memory.dmp	upx
behavioral2/memory/1916-36-0x0000000000F70000-0x0000000000FB5000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_2910178ae5f8b9ec62234e38cbd150a1_amadey_darkgate_elex_smoke-loader_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1056	1916	2026-07-11_2910178ae5f8b9ec62234e38cbd150a1_amadey_darkgate_elex_smoke-loader_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_2910178ae5f8b9ec62234e38cbd150a1_amadey_darkgate_elex_smoke-loader_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_2910178ae5f8b9ec62234e38cbd150a1_amadey_darkgate_elex_smoke-loader_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\cscript.exe
  cscript //NoLogo C:\Users\Admin\AppData\Local\Temp\hd.vbs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Downloader.log

Path C:\Users\Admin\AppData\Local\Temp\Downloader.log
Size 1KB
SHA256 744238d424e688ee6807b0202314c7c49caf239e8d86a64f3f39cb428c4c67a6
MD5 2064d101752925e762dafd6bcf62e5cc
SHA1 a1bd6423b64e8c4c9608d26a154577e4cb47fb16
SHA512 24b7d510aa82f824209fa386ae39e9a25c69912c0a6feac2fe9180e1cccc84b6247e278b20eb07205d210f73d88f90ad2d4e8e622f7b9ae0abb82b713274d1a6
TLSH
T1F7318667F82D08EB791B33A1164F3EC64BEF2C50051DED365098E4EEB60A8601D7F585
MD5 SHA1 SHA512 TLSH

Submit Download

hd.vbs

Path C:\Users\Admin\AppData\Local\Temp\hd.vbs
Size 245B
SHA256 4bd3521fb2b5c48fe318a874bf64c6b1f62f5212b8c88790006cafaf31d207ba
MD5 d8682d715a652f994dca50509fd09669
SHA1 bb03cf242964028b5d9183812ed8b04de9d55c6e
SHA512 eaa39d87002df1eea16b215c9f099731253b7af72e46b12f64423874dbcdd8f68a164d7641bafb3f854aa6ad8aa7269da59ed0b32cd41eccba5d6f296f9a52ca
TLSH
T13ED0970008C3872000393301E9D7998BB7C8450C600837442DE8C95C02E7839E0F8ADB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1916-0-0x0000000000F70000-0x0000000000FB5000-memory.dmp

Download

memory/1916-1-0x0000000000F91000-0x0000000000F92000-memory.dmp

Download

memory/1916-36-0x0000000000F70000-0x0000000000FB5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads