0914171be22bfd80c7d0b928b3f173eebe16dabd78b4f331bc3dd77ee1040d60

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_ea25223c93ac20b225fbe4b02f35d6d8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260715-k37flaf15m
SHA256 0914171be22bfd80c7d0b928b3f173eebe16dabd78b4f331bc3dd77ee1040d60
MD5 ea25223c93ac20b225fbe4b02f35d6d8
SHA1 16ea715503197b0286accc46fdf4887253d6c3f4
SHA512 114574c98635e4e5f84b376bae158bef671fc62683dcdd896bd8aadb7124393331ce24b10d9ae49c63b1b32ff1adcf072c97fe9f9b2a91fd8b825f51040eac2b
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroP:kIAFGBIaEwK70K7b
TLSH
T164B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4404	eviklle.exe
5396	eviklle.exe
1120	eviklle.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\eviklle.exe	2026-07-15_ea25223c93ac20b225fbe4b02f35d6d8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\eviklle.exe	eviklle.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1516	4404	WerFault.exe	87
4980	1120	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_ea25223c93ac20b225fbe4b02f35d6d8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4404	eviklle.exe
4404	eviklle.exe
1120	eviklle.exe
1120	eviklle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	eviklle.exe
Token: SeDebugPrivilege	1120	eviklle.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 2384	4404	eviklle.exe	81
PID 1120 wrote to memory of 2384	1120	eviklle.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2384
- C:\Users\Admin\AppData\Local\Temp\2026-07-15_ea25223c93ac20b225fbe4b02f35d6d8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-15_ea25223c93ac20b225fbe4b02f35d6d8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5584

C:\PROGRA~3\Mozilla\eviklle.exe
"C:\PROGRA~3\Mozilla\eviklle.exe" -zjllbpk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 528
  2⤵
  - Program crash
  PID:1516

C:\PROGRA~3\Mozilla\eviklle.exe
C:\PROGRA~3\Mozilla\eviklle.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4404 -ip 4404
1⤵
PID:3456

C:\PROGRA~3\Mozilla\eviklle.exe
"C:\PROGRA~3\Mozilla\eviklle.exe" -zjllbpk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 512
  2⤵
  - Program crash
  PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1120 -ip 1120
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eviklle.exe

Path C:\ProgramData\Mozilla\eviklle.exe
Size 107KB
SHA256 346bf07c6b7d9a875f7913782fd476359666c9a8c3d9418be48a7be65409069c
MD5 3886fbbe04a2f1fc8167b7eb2bb86743
SHA1 ee7a29614a9d946ee122bd3d601cfd6a06db3fca
SHA512 c8c3fb3b1e57734da83500e1bf1b619bdf4399d8b423179dc59179f2b98f0d95acf26a7835688f640ff3b3edfa99b344c5b8eba917712a8d7c3f047f87a66386
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrom:kIAFGBIaEwK70K7K
TLSH
T1AFB38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB17883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eviklle.exe

Path C:\ProgramData\Mozilla\eviklle.exe
Size 107KB
SHA256 e9401a97afff5654606dd2fec0cd90440eb12a9e26207a68711986ff57612ba2
MD5 fab4dd934ec6122c64b872c7d498472e
SHA1 0ac064ad7cd23f17720b8ddde3e0a073843a481b
SHA512 776c228999e4cc3a2608b928f048372a792476aa7535f117c4043c840f5cf0f8483e51dc2d8a63846ae9b3203674507db6803ca2056e3c119429c5b32962a130
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroP:kIAFGBIaEwK70K7T
TLSH
T133B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2384-4-0x0000000001030000-0x000000000104C000-memory.dmp

Download

memory/5396-6-0x0000000000E30000-0x0000000000E8EF1C-memory.dmp

Download