566521cd353301e46960708fdb1468a1f05da949af6b7043894bc3f93d1a0683

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_cbd2de8c15cdd4561a6180fc4d67b892_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260803-cmpa3swflg
SHA256 566521cd353301e46960708fdb1468a1f05da949af6b7043894bc3f93d1a0683
MD5 cbd2de8c15cdd4561a6180fc4d67b892
SHA1 765493d4a7d78056d510b81726fb6199a0648452
SHA512 7d7fe6eab05a2a805d6641b5db31c11224f27aab0062b42647e4bc4491b83ca75c57b01e0095d853ebcb9824b28bc9109ff62ef396abc6a96f4049da6c8cbd0b
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroR:ARBuA6AIIK70K7V
TLSH
T1DB848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
880	rlgwbqe.exe
5692	rlgwbqe.exe
2960	rlgwbqe.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\rlgwbqe.exe	2026-08-03_cbd2de8c15cdd4561a6180fc4d67b892_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\rlgwbqe.exe	rlgwbqe.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1200	880	WerFault.exe	88
1444	2960	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_cbd2de8c15cdd4561a6180fc4d67b892_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgwbqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgwbqe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgwbqe.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
880	rlgwbqe.exe
880	rlgwbqe.exe
2960	rlgwbqe.exe
2960	rlgwbqe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	880	rlgwbqe.exe
Token: SeDebugPrivilege	2960	rlgwbqe.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3224	880	rlgwbqe.exe	55
PID 2960 wrote to memory of 3224	2960	rlgwbqe.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3224
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_cbd2de8c15cdd4561a6180fc4d67b892_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_cbd2de8c15cdd4561a6180fc4d67b892_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5636

C:\PROGRA~3\Mozilla\rlgwbqe.exe
C:\PROGRA~3\Mozilla\rlgwbqe.exe -gehdxpf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 504
  2⤵
  - Program crash
  PID:1200

C:\PROGRA~3\Mozilla\rlgwbqe.exe
C:\PROGRA~3\Mozilla\rlgwbqe.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 880 -ip 880
1⤵
PID:3784

C:\PROGRA~3\Mozilla\rlgwbqe.exe
C:\PROGRA~3\Mozilla\rlgwbqe.exe -gehdxpf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 484
  2⤵
  - Program crash
  PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2960 -ip 2960
1⤵
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rlgwbqe.exe

Path C:\ProgramData\Mozilla\rlgwbqe.exe
Size 380KB
SHA256 803302a177f14896d7e10a02efcf4080fe1a55f919ec4855ec6c0172ce17cb5a
MD5 ae3b752af6b363fa4b48985e33a3c210
SHA1 5b95bc66c223f138f52c70532eff6987d558574b
SHA512 74c4f17d7215b29c1ee5115f8c4cb1be0dc3e5c1849d9f1b2dbe2224399ff78528f95838e66234862d0fd9c36d7b393ea225f1e44ce6e0805d6230963c9d8c23
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYrod:ARBuA6AIIK70K7Z
TLSH
T10A848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgwbqe.exe

Path C:\ProgramData\Mozilla\rlgwbqe.exe
Size 380KB
SHA256 962d56b7202b13982a688f9ae6b2a1371e1d13c58ca5a05a56e35016f49c6a90
MD5 6a18ab53da7254f3f4360fe901ac5190
SHA1 4942528ae04a7c9f40d6a698a51c4ec8f3498679
SHA512 4e6083e337632b86fff87bdc9e84f832bdebe622319acf9cafe8539237e08458692914c5da8f66d665d9877f93739c56bb61b7d29478f1d250600b5713bbdeb8
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYrow:ARBuA6AIIK70K7k
TLSH
T119848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/880-4-0x0000000000EA8000-0x0000000000EA9000-memory.dmp

Download

memory/3224-6-0x00000000012E0000-0x00000000012FC000-memory.dmp

Download

memory/5636-0-0x00000000002C8000-0x00000000002C9000-memory.dmp

Download

memory/5692-9-0x0000000000EA0000-0x0000000000EFEF1C-memory.dmp

Download