f23194f666b023edd1f8b449f06166c8f0efdf707720e5d626e338c9f3edfb0d

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_3fb32b55813c1bde325bbc8625e1d771_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260809-ynezpavdme
SHA256 f23194f666b023edd1f8b449f06166c8f0efdf707720e5d626e338c9f3edfb0d
MD5 3fb32b55813c1bde325bbc8625e1d771
SHA1 d2fd2285327c82d111587a29d5c3df5aacd139e2
SHA512 394f0533b899d52c18742e38ebd64c90bedb361c5e502c487286bfb60fc260c6d4a5b810a947b37171021180bd5e94784fe5bd593ba28be3fa03fa3a21f04761
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYro9:kIAFGBIaEwK70K7h
TLSH
T16BB38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1284	hmbbcsh.exe
4284	hmbbcsh.exe
3904	hmbbcsh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\hmbbcsh.exe	2026-08-09_3fb32b55813c1bde325bbc8625e1d771_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\hmbbcsh.exe	hmbbcsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2524	1284	WerFault.exe	89
4588	3904	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hmbbcsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hmbbcsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hmbbcsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_3fb32b55813c1bde325bbc8625e1d771_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1284	hmbbcsh.exe
1284	hmbbcsh.exe
3904	hmbbcsh.exe
3904	hmbbcsh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	hmbbcsh.exe
Token: SeDebugPrivilege	3904	hmbbcsh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4812	1284	hmbbcsh.exe	81
PID 3904 wrote to memory of 4812	3904	hmbbcsh.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4812
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_3fb32b55813c1bde325bbc8625e1d771_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_3fb32b55813c1bde325bbc8625e1d771_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4628

C:\PROGRA~3\Mozilla\hmbbcsh.exe
"C:\PROGRA~3\Mozilla\hmbbcsh.exe" -gvhpvtc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 528
  2⤵
  - Program crash
  PID:2524

C:\PROGRA~3\Mozilla\hmbbcsh.exe
C:\PROGRA~3\Mozilla\hmbbcsh.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 232 -p 1284 -ip 1284
1⤵
PID:3472

C:\PROGRA~3\Mozilla\hmbbcsh.exe
"C:\PROGRA~3\Mozilla\hmbbcsh.exe" -gvhpvtc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 504
  2⤵
  - Program crash
  PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3904 -ip 3904
1⤵
PID:5132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hmbbcsh.exe

Path C:\ProgramData\Mozilla\hmbbcsh.exe
Size 107KB
SHA256 0c646ea4856bab7dc1c8591fb96d86ce3ecdaa3641c21460b2e9a5e92c1db6a0
MD5 0c3a3a7c21c52b60ad4aad73b4410c98
SHA1 ba2f6d696215864c2cc4263c5186b44ac0af1e99
SHA512 6a362a6e2288bffd77916e597c83f01763c68aae37737f0c068cecd0c52c9cd8d277b5bc55a5e5ce7bad1d8a13c72bda00c734d7b642569b32644d298fd25975
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroO:kIAFGBIaEwK70K7C
TLSH
T1BEB38E41F3D0DD66F05C253184A746B30BB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hmbbcsh.exe

Path C:\ProgramData\Mozilla\hmbbcsh.exe
Size 107KB
SHA256 66489b454fb3f798cc7a462bf1f3dc06c84ed14a409c99769f6bf1679fbf463a
MD5 a24e5279801c25acef8d26fce8ab93aa
SHA1 d6f64acff609d58770ab2539648861d335b74a1e
SHA512 054f1e775ecd7f5ae1bf03945af5f87fb59e458cea06565d49c26e8c470139b8c426ae0139ae779f1b6167f42ed71991575df499de7a6b4eda1e13970b67dc73
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroW:kIAFGBIaEwK70K7a
TLSH
T165B38E41F3D0DD66F05C253184A746B30BB5ED1297B125AB27883BAFDD702A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-6-0x00000000004E0000-0x000000000053EF1C-memory.dmp

Download

memory/4812-4-0x00000000039C0000-0x00000000039DC000-memory.dmp

Download