6f623b79246e03913ffaff2dbd3cbf91fd813f86e3796f4ec3c468f4d7e639c5

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_51751e340134bc9b1a46dd020fa8d9f7_amadey_darkgate_elex_smoke-loader.exe
Size 88KB
Sample260802-etefkadj5t
SHA256 6f623b79246e03913ffaff2dbd3cbf91fd813f86e3796f4ec3c468f4d7e639c5
MD5 51751e340134bc9b1a46dd020fa8d9f7
SHA1 da7169a9076f6ce61875f2cbb82e9f512db0e63a
SHA512 fb9478e3688448acc52cb4a7572465e4cb3845ec2916a9fe97c699ea3cce6a42887cd300210fa8a3e4eb53cad1222327671905f88fcb9214b79b9f941cea509e
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTiU:wCCSUacxmurlg0v4iRZCpf
TLSH
T1DC93282163E840B2E2765F3CC1B2A6D1062A7D527EF1F14F6E8471D94F736C0AAB1726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2224	guzakbet.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_51751e340134bc9b1a46dd020fa8d9f7_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guzakbet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 2224	4316	2026-08-01_51751e340134bc9b1a46dd020fa8d9f7_amadey_darkgate_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_51751e340134bc9b1a46dd020fa8d9f7_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_51751e340134bc9b1a46dd020fa8d9f7_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guzakbet.exe

Path C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
Size 88KB
SHA256 2a3e67a3d30ef6a148341cf3fc12f1540605daaf1283e6b535dd3f267c8231f7
MD5 ad1d1aa5951e478674eda7b7039d64b2
SHA1 62bc7c5d0893ca8bbf596dca12847e3372fc3dcf
SHA512 4225b364c4296e861f5ef09e3fe10cd5524dcf4d8ce0ec48d546109873a1376c0e7b7eba115f0b044519f7c9c377eacb5a5afe6ceaed2299f31f3e92dacb3d67
SSDEEP 1536:dToccCCSUacxmuhUOl210vjjODk0iRu5SMwXRTWxkwTl8YTiiY:wCCSUacxmurlg0v4iRZCpk
TLSH
T1D693182163E840B2E2765F3CC1B2A6D1062A7D527EF1F14F6D8471D94F736C0AAB1B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads