439c0bdb0ceec7823755233a227ebba9b79c81c34a91662b403446e868a07416

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260801-bfc4sstybz
SHA256 439c0bdb0ceec7823755233a227ebba9b79c81c34a91662b403446e868a07416
MD5 87805180e9fe0229245ac1b0911e100e
SHA1 dea8cd884b58a4d7f3e065c5c3d5281a686d78b8
SHA512 95e7715e1986ad5bde83429505a382dc7e7cfc0f2399c2a0a3b3507d267e3ae8def0dcf6a563ee24176f180924aef54d7102adcd2c280087e398c9fffe7fecad
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroR:ARBuA6AIIK70K7l
TLSH
T151848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5276	xvrfhme.exe
1924	xvrfhme.exe
2728	xvrfhme.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\xvrfhme.exe	2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\xvrfhme.exe	xvrfhme.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1964	5276	WerFault.exe	89
2096	2728	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvrfhme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvrfhme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvrfhme.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5276	xvrfhme.exe
5276	xvrfhme.exe
2728	xvrfhme.exe
2728	xvrfhme.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5276	xvrfhme.exe
Token: SeDebugPrivilege	2728	xvrfhme.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5276 wrote to memory of 1184	5276	xvrfhme.exe	80
PID 2728 wrote to memory of 1184	2728	xvrfhme.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_87805180e9fe0229245ac1b0911e100e_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3332

C:\PROGRA~3\Mozilla\xvrfhme.exe
"C:\PROGRA~3\Mozilla\xvrfhme.exe" -greiuib
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 528
  2⤵
  - Program crash
  PID:1964

C:\PROGRA~3\Mozilla\xvrfhme.exe
C:\PROGRA~3\Mozilla\xvrfhme.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 244 -p 5276 -ip 5276
1⤵
PID:2688

C:\PROGRA~3\Mozilla\xvrfhme.exe
"C:\PROGRA~3\Mozilla\xvrfhme.exe" -greiuib
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 512
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2728 -ip 2728
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xvrfhme.exe

Path C:\ProgramData\Mozilla\xvrfhme.exe
Size 380KB
SHA256 94169abd182995a54bedcba51e0bdbd8560d60e3b017a3aecc7d10daea1f0849
MD5 119c7d4334f7af0fcc9735881c3e3d1d
SHA1 da6ceb109e7ff863a5bf559a3cb1257de2c74424
SHA512 8ce832bd355aae5794eb9126a4a778373061cdc3eb6c4b349a2ba9a5ecc0ee70e87378de156883174e5a0ae35fc96e01b310b725607c7fc8453fe680fe4666ab
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroI:ARBuA6AIIK70K7E
TLSH
T147848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvrfhme.exe

Path C:\ProgramData\Mozilla\xvrfhme.exe
Size 380KB
SHA256 ae1a86d6009d9dda8584f4f130ba7c4ac6dd50471182a0ced95ec9b6a7725eca
MD5 b7234c4e720db85497ff4b3b6bd0923f
SHA1 c3abcfd4eb7a24c240119693b0bbca15f062dbba
SHA512 21161e5eb2aa6f459c335445bcf5a6005dec3bbbcb35304e87fe85b4a13434cf913be4d8c61c152e2fd83052f81a9302a21384004cde3fb2eaeee6eb6f34a5b6
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroU:ARBuA6AIIK70K7A
TLSH
T1BA848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-6-0x0000000000BA0000-0x0000000000BBC000-memory.dmp

Download

memory/1924-8-0x0000000000ED0000-0x0000000000F2EF1C-memory.dmp

Download

memory/3332-0-0x0000000000838000-0x0000000000839000-memory.dmp

Download

memory/5276-4-0x0000000000ED8000-0x0000000000ED9000-memory.dmp

Download