439c0bdb0ceec7823755233a227ebba9b79c81c34a91662b403446e868a07416

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260801-bfc4sstybz
SHA256 439c0bdb0ceec7823755233a227ebba9b79c81c34a91662b403446e868a07416
MD5 87805180e9fe0229245ac1b0911e100e
SHA1 dea8cd884b58a4d7f3e065c5c3d5281a686d78b8
SHA512 95e7715e1986ad5bde83429505a382dc7e7cfc0f2399c2a0a3b3507d267e3ae8def0dcf6a563ee24176f180924aef54d7102adcd2c280087e398c9fffe7fecad
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroR:ARBuA6AIIK70K7l
TLSH
T151848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4800	vcgxqhd.exe
4796	vcgxqhd.exe
1252	vcgxqhd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\vcgxqhd.exe	2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\vcgxqhd.exe	vcgxqhd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3948	4800	WerFault.exe	86
2240	1252	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4800	vcgxqhd.exe
4800	vcgxqhd.exe
1252	vcgxqhd.exe
1252	vcgxqhd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	vcgxqhd.exe
Token: SeDebugPrivilege	1252	vcgxqhd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3160	4800	vcgxqhd.exe	56
PID 1252 wrote to memory of 3160	1252	vcgxqhd.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3160
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4708

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe -zoiucwg
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 504
  2⤵
  - Program crash
  PID:3948

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4800 -ip 4800
1⤵
PID:4840

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe -zoiucwg
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 484
  2⤵
  - Program crash
  PID:2240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1252 -ip 1252
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcgxqhd.exe

Path C:\ProgramData\Mozilla\vcgxqhd.exe
Size 380KB
SHA256 f11c826c2a8d67514608ac59bca49e579319515d7372fff47dd538b99630e0df
MD5 541abfab16eb0ea9b2d245ff63a6254f
SHA1 f3bf0b2b874b4c65676a9f7be50ac367864c3745
SHA512 4978753763279df59c8fde746bb6d71c5ee5e5706cc2b2aa9e8fa43b0c4111e75ce60174c10ae833227e338b064440c4813057423349771703cf4c53e549a6a9
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYro8:ARBuA6AIIK70K7g
TLSH
T18A848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcgxqhd.exe

Path C:\ProgramData\Mozilla\vcgxqhd.exe
Size 380KB
SHA256 e109360e60c908319b240c149eac71cfedc289be96a4b323b24f2433129ab7ec
MD5 b1a8d2a107667807cf9912ae072d3250
SHA1 60fb9ae62123cf5abc79a4ddb7e498b323b46945
SHA512 61e7d7c042a5e99fa1754ac5a678362d40a31d4fed88a8e9ab52874cd4202e6c8e4b2bcdd3276e601dcb572ab79df4799423e7e3f15f2ef9651d642b65de3bf2
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroL:ARBuA6AIIK70K7/
TLSH
T190848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3160-6-0x0000000006DB0000-0x0000000006DCC000-memory.dmp

Download

memory/4708-0-0x0000000000D68000-0x0000000000D69000-memory.dmp

Download

memory/4796-9-0x00000000008E0000-0x000000000093EF1C-memory.dmp

Download

memory/4800-4-0x00000000008E8000-0x00000000008E9000-memory.dmp

Download