e6bc7e21feccf0028f5e14a6cf0c5783dc3f01b372217279ad4cf8e08ecf0d59

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_11dfab613398659c945c19e26d0fe56f_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260715-mlv3cadv8z
SHA256 e6bc7e21feccf0028f5e14a6cf0c5783dc3f01b372217279ad4cf8e08ecf0d59
MD5 11dfab613398659c945c19e26d0fe56f
SHA1 60713fb2a8c5371ce4d4f29593c88de10cec1d37
SHA512 9f2d843a95b0c40bbfc2d24b3230023d14756d2554e588b4ced70099d5f6906fe2e34e0f2b868f97f520ee8c67e63b1974165528a635b5cf4f1940a53cedf49e
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrot:kIAFGBIaEwK70K7B
TLSH
T19AB38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4780	rgdezwn.exe
4364	rgdezwn.exe
2524	rgdezwn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\rgdezwn.exe	2026-07-15_11dfab613398659c945c19e26d0fe56f_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\rgdezwn.exe	rgdezwn.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5012	4780	WerFault.exe	87
4224	2524	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgdezwn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgdezwn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_11dfab613398659c945c19e26d0fe56f_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgdezwn.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4780	rgdezwn.exe
4780	rgdezwn.exe
2524	rgdezwn.exe
2524	rgdezwn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4780	rgdezwn.exe
Token: SeDebugPrivilege	2524	rgdezwn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4156	4780	rgdezwn.exe	81
PID 2524 wrote to memory of 4156	2524	rgdezwn.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4156
- C:\Users\Admin\AppData\Local\Temp\2026-07-15_11dfab613398659c945c19e26d0fe56f_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-15_11dfab613398659c945c19e26d0fe56f_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:704

C:\PROGRA~3\Mozilla\rgdezwn.exe
"C:\PROGRA~3\Mozilla\rgdezwn.exe" -roaccxj
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4780 -s 528
  2⤵
  - Program crash
  PID:5012

C:\PROGRA~3\Mozilla\rgdezwn.exe
C:\PROGRA~3\Mozilla\rgdezwn.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4780 -ip 4780
1⤵
PID:4864

C:\PROGRA~3\Mozilla\rgdezwn.exe
"C:\PROGRA~3\Mozilla\rgdezwn.exe" -roaccxj
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 500
  2⤵
  - Program crash
  PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2524 -ip 2524
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rgdezwn.exe

Path C:\ProgramData\Mozilla\rgdezwn.exe
Size 107KB
SHA256 faa5b24c6f4220a1e337a46756db351a4ac8b2e20e26eb5b2d52a9e51b54d325
MD5 4ebd2fbb8c05d07527a67a0596e21918
SHA1 8663caa2544be2517a296630b874ed096e1e4ff3
SHA512 aa9016619637712ed26dc661a57c0a56b295c7f40770c18cbb038d73e5056a52c634d6d8061502899b1a8038a898ef9bd9752cf2fba2617f4459d020dd1a31f9
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrok:kIAFGBIaEwK70K7Y
TLSH
T1F5B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rgdezwn.exe

Path C:\ProgramData\Mozilla\rgdezwn.exe
Size 107KB
SHA256 034db79bae94785da3b669364be2b814402bd61d5aa1971d63d139f01d8e8b6f
MD5 791e3565e50982fb75333efd23823f14
SHA1 22907577919c71be9a073ec7cd80b18b5c98a57c
SHA512 52f0d28feaee272aa8526abc5b1bd445c660c6c2ce2a68fd726431ed813f846da081aeb917b63ac9b3390a28ab384ca0e4d4df71083a0e770f28003f1426a1ce
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroe:kIAFGBIaEwK70K7q
TLSH
T10FB38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4156-4-0x00000000009A0000-0x00000000009BC000-memory.dmp

Download

memory/4364-6-0x0000000000250000-0x00000000002AEF1C-memory.dmp

Download