Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 08:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe
- Size 1.2MB
- Sample260720-kkchhaby2l
- SHA256 d2fd6b0a3b48d34e23dd52d4934c463322fb63945484c442847d2699ff4c2147
- MD5 d69a8902b738fe5d8276b57104ab5c16
- SHA1 6c3e28a5a92de09551459791c5f3dffa6b673266
- SHA512 866a440a0dc0c43a1e989da0dd926f2edc44d03a1ede3cb07cccd03caebee7de7362aa629bc71c74ad2c3c6a07fbf9a3c3dfca5dd84a75953f040610370e7458
- SSDEEP 12288:Cr2gF+avdr8U8+dbNRQ6uOd4zY0tuXq12RL2ZO6irs6vuBNyQe:CKgF+a18U82QDY3qERSZO8gqsH
- TLSH T1AD45080277F95129F1F3BBB1EEB992645A77BC61AD3DC50E5280025E0DB4A90DA32733
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 40 IoCs
resource yara_rule behavioral2/memory/4856-53-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-90-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-91-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-96-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-92-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-97-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-98-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-95-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-94-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-93-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-107-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-108-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-109-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-110-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-111-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-112-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-114-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-116-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-117-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-118-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-120-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-122-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-125-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-127-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-129-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-135-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-138-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-140-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-141-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-142-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-145-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-147-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-148-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-149-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-151-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-153-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-158-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-159-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-163-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4856-343-0x00000000025C0000-0x000000000367A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 42 IoCs
resource yara_rule behavioral2/memory/4856-53-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-90-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-91-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-96-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-92-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-97-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-98-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-95-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-94-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-93-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-102-0x0000000000400000-0x0000000000533000-memory.dmp UPX behavioral2/memory/4856-107-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-108-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-109-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-110-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-111-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-112-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-114-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-116-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-117-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-118-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-120-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-122-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-125-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-127-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-129-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-135-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-138-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-140-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-141-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-142-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-145-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-147-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-148-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-149-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-151-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-153-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-158-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-159-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-163-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-343-0x00000000025C0000-0x000000000367A000-memory.dmp UPX behavioral2/memory/4856-358-0x0000000000400000-0x0000000000533000-memory.dmp UPX - Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\N: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\T: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\U: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\Z: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\D: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\H: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\O: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\R: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\X: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\I: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\J: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\L: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\S: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\W: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\G: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\M: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\P: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\Q: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\V: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened (read-only) \??\Y: 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification F:\autorun.inf 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe -
resource yara_rule behavioral2/memory/4856-53-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-90-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-91-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-96-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-92-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-97-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-98-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-95-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-94-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-93-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-107-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-108-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-109-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-110-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-111-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-112-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-114-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-116-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-117-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-118-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-120-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-122-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-125-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-127-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-129-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-135-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-138-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-140-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-141-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-142-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-145-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-147-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-148-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-149-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-151-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-153-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-158-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-159-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-163-0x00000000025C0000-0x000000000367A000-memory.dmp upx behavioral2/memory/4856-343-0x00000000025C0000-0x000000000367A000-memory.dmp upx - Drops file in Program Files directory 13 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\e591ac2 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe Token: SeDebugPrivilege 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 1200 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 15 PID 4856 wrote to memory of 2972 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 43 PID 4856 wrote to memory of 712 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 45 PID 4856 wrote to memory of 3452 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 50 PID 4856 wrote to memory of 3116 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 57 PID 4856 wrote to memory of 4344 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 59 PID 4856 wrote to memory of 4392 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 60 PID 4856 wrote to memory of 4440 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 61 PID 4856 wrote to memory of 4724 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 63 PID 4856 wrote to memory of 5000 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 64 PID 4856 wrote to memory of 5172 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 65 PID 4856 wrote to memory of 5276 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 66 PID 4856 wrote to memory of 4700 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 79 PID 4856 wrote to memory of 4628 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 80 PID 4856 wrote to memory of 2736 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 81 PID 4856 wrote to memory of 4256 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 82 PID 4856 wrote to memory of 1080 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 83 PID 4856 wrote to memory of 1200 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 15 PID 4856 wrote to memory of 2972 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 43 PID 4856 wrote to memory of 712 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 45 PID 4856 wrote to memory of 3452 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 50 PID 4856 wrote to memory of 3116 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 57 PID 4856 wrote to memory of 4344 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 59 PID 4856 wrote to memory of 4392 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 60 PID 4856 wrote to memory of 4440 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 61 PID 4856 wrote to memory of 4724 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 63 PID 4856 wrote to memory of 5000 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 64 PID 4856 wrote to memory of 5172 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 65 PID 4856 wrote to memory of 5276 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 66 PID 4856 wrote to memory of 4700 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 79 PID 4856 wrote to memory of 4628 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 80 PID 4856 wrote to memory of 2736 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 81 PID 4856 wrote to memory of 4256 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 82 PID 4856 wrote to memory of 1080 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 83 PID 4856 wrote to memory of 1200 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 15 PID 4856 wrote to memory of 2972 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 43 PID 4856 wrote to memory of 712 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 45 PID 4856 wrote to memory of 3452 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 50 PID 4856 wrote to memory of 3116 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 57 PID 4856 wrote to memory of 4344 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 59 PID 4856 wrote to memory of 4392 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 60 PID 4856 wrote to memory of 4440 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 61 PID 4856 wrote to memory of 4724 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 63 PID 4856 wrote to memory of 5000 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 64 PID 4856 wrote to memory of 5172 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 65 PID 4856 wrote to memory of 5276 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 66 PID 4856 wrote to memory of 4700 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 79 PID 4856 wrote to memory of 4628 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 80 PID 4856 wrote to memory of 2736 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 81 PID 4856 wrote to memory of 4256 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 82 PID 4856 wrote to memory of 1080 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 83 PID 4856 wrote to memory of 1200 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 15 PID 4856 wrote to memory of 2972 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 43 PID 4856 wrote to memory of 712 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 45 PID 4856 wrote to memory of 3452 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 50 PID 4856 wrote to memory of 3116 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 57 PID 4856 wrote to memory of 4344 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 59 PID 4856 wrote to memory of 4392 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 60 PID 4856 wrote to memory of 4440 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 61 PID 4856 wrote to memory of 4724 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 63 PID 4856 wrote to memory of 5000 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 64 PID 4856 wrote to memory of 5172 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 65 PID 4856 wrote to memory of 5276 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 66 PID 4856 wrote to memory of 4700 4856 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe 79 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:712
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3452
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4344
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4440
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4724
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:5000
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5172
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5276
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4700
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_d69a8902b738fe5d8276b57104ab5c16_amadey_darkgate_elex_icedid_smoke-loader_stop.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4856 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"4⤵PID:5032
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:2736
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4256
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:1080
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 782B
- SHA256 8395f93b0e0240f5c79ce70bc2257f9cb0d92227b15f7724ba65b1c5c0b19625
- MD5 29f1b2d1b6f9290138596cf180847e53
- SHA1 ab496ce19c74cb15fe0b38807cf29db776336461
- SHA512 bdadd50c6371d05f5d43fe7f95e8c02bd74842b0a7b982f571e80520d8748d67fc6f3912f9eb797edc476387168d597747b9a8705ded1ea473e5ee160c627227
- TLSH T1E0014C531AE81125F1B35A44DFF9947357327C975C2DC8AC90D8520E49E1940D5B27BB
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest2.msi
- Size 18KB
- SHA256 0abcb8b7c0bda3128316b3e4f4a5857e9c8194105043a0c0e9801a1a96105d01
- MD5 f5d4c05bc8ea0d4fc4d277abda7369d9
- SHA1 f67e793b159bd1e75ed4dec0de352ea1b6583708
- SHA512 359a966c4dc8d62a570b428dfb3e666a63efd6bfff7c5b5ace3bc97ea09ba701d9fa524f439bf9902746c2ecac9c1f76c90868b0152eb825b2a09a9474fdbb34
- SSDEEP 384:MrUq75oUFtb0F+o5nfy9jdIYigYws0i9Db9Ey8RbmL4A8UiINyGNB:MrUq75oUFtb0F+o5nfy9uYigY9K5ALdH
- TLSH T19D820BA2B4408C11CD868F3EA4C1D726D672BC813D8591C27565F219CFB23869A9F7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 251KB
- SHA256 3c0c26c4f5738959ee1bb4bb75098d3515dbc8b7a06ea3d361acbcea3502b371
- MD5 877c3e51957ef4f666d1d0e48d3e5427
- SHA1 050ed353f1deb41bca4a4b0937c0f0a32cbfcc9d
- SHA512 e8286dad87ac30d413662344c23b3d833556572974aefa5b15305ea7d76c8c437c40d7a7f985deebd9b76f3a86ca42298b6e45ee2d6f7b8bcf35e2ae4f3583b7
- SSDEEP 3072:wT4DJAlCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xdUzH5
- TLSH T1BA44E44263FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpE1D.tmp
- Size 3KB
- SHA256 19fe53c801ad7edc635f61e9e28d07da31780c2480e6f37ecfc63fffe1b250fe
- MD5 ec946860cff4f4a6d325a8de7d6254d2
- SHA1 7c909f646d9b2d23c58f73ec2bb603cd59dc11fd
- SHA512 38a98b18dbae063bc533a1ff25a3467a7de197651e07e77a1b22cf8ce251282ab31f61dcff5c51ef186cfd115dc506181d480eabffbe92af01dee6282cbee13e
- TLSH T10971B9DB092A5413ABC7DE8AA2C5F3774C34A7E45B96548B087C95C34FCBB971B4401D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpE3D.tmp
- Size 3KB
- SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
- MD5 fc2430057cb1be74c788f10c2d4540c8
- SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
- SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
- TLSH T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\TmpF6D9.tmp
- Size 3KB
- SHA256 ff9b4cf04e3202f150f19c1711767361343935da7841c98b876c42fd2cabce9b
- MD5 bbb796dd2b53f7fb7ce855bb39535e2f
- SHA1 dfb022a179775c82893fe8c4f59df8f6d19bd2fd
- SHA512 0d122f454fcbf4524c2756692f0f33dc98f5bd2426839c6f03cd5c5f4fd507a8a15cf489d7a7ceadd1b95cf31b506c04bf03d613a9ba7d76add92766b1dc5c2b
- TLSH T10D71D9CF0D1A6413ABC7ED8EB1C5F3AB4C34A7E06AD1588B05B895C24FC3B862A5905D
- MD5 SHA1 SHA512 TLSH
- Path C:\kegm.exe
- Size 97KB
- SHA256 ade8ae99abc7ec55d5e57c67f88d713af17c61649f1147390336523a6d4fb93d
- MD5 ad8d0edeba78c79e2966a59c80b2404d
- SHA1 b7c6b1af8d2b0f22b8c369e8cc5c0b81a9af32b2
- SHA512 766583f338f62976dd5b3a2687105b6093f3707e360198b0230d38be1b0581677b33211137076c0cb3534904b9ac183da2703620707354374cd73544d85d7b9c
- SSDEEP 1536:GYDH3W29k0Q64aOLImZlRa524RCqytOAzkNfmJP8YeI/4Wsxs5NkMOq9HEYV:ZXW2Z6M+RixRCqmzkNfmv7cxENkEkYV
- TLSH T162A302E3F04BB619F5885A3AC404F97764AC3651BE85F7BA21D730906B6044BA8F7F12
- MD5 SHA1 SHA512 SSDEEP TLSH