1c6ed667e9cf3beb66570787f94110b85de3cbab2e25fbc9873f22da526e690e

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0bc2793ce461d5a451edb68017b985c2_amadey_darkgate_elex_smoke-loader.exe
Size 85KB
Sample260809-mfpy5sy1f1
SHA256 1c6ed667e9cf3beb66570787f94110b85de3cbab2e25fbc9873f22da526e690e
MD5 0bc2793ce461d5a451edb68017b985c2
SHA1 f309f60b3239f0c515caa7dd9a7b9914eca280dc
SHA512 cd0576a85e06d8926c88c828c0e0dbf444193779206da9d3836cb2bb987f82ccad0171b644618ac70c40061f4b3519f684bda5621966d295bef92d2a973584cd
SSDEEP 1536:fTw3gWhUelqxsvLjCXk0GPW5SMwXRTWxkwTl8YTij:8gWjlEsvkGPBCp4
TLSH
T1C183496272D84072D5611F3CC0B2A6C21A6A7D127EF0F44F6E8875E95F732C06AB9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4296	guzakbet.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_0bc2793ce461d5a451edb68017b985c2_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	guzakbet.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4296	1324	2026-08-09_0bc2793ce461d5a451edb68017b985c2_amadey_darkgate_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0bc2793ce461d5a451edb68017b985c2_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0bc2793ce461d5a451edb68017b985c2_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

guzakbet.exe

Path C:\Users\Admin\AppData\Local\Temp\guzakbet.exe
Size 85KB
SHA256 1f5d0c53b367082f70258ab56bf1b0a2c5e88bfd6d94d9614e6c295dfd976869
MD5 8c82b1355937c3dca73e9cf3ec8ea448
SHA1 701ab7ccad0487b3d2a975229590a6b9ad02df6e
SHA512 7940e71a187a4601cfddcf0bcdbe5cc627a277c70299e4e33b89319c805b4e6dc431da2837711cfa0babfb56c292f6f6ca3b23fd96f527af3a20169f123ed64f
SSDEEP 1536:fTw3gWhUelqxsvLjCXk0GPW5SMwXRTWxkwTl8YTiwW:8gWjlEsvkGPBCps
TLSH
T1EE834A6272D84172E5611F3CC0B2A6C21A6A7D117EF0F44F6E8875E94F732C06AB9B53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads