a7b7597406719cb7e03edff8a024039f941b689abf4767bbd2ee172a317b02b7

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_20b93a44f94294ec08ee31d28e51ba8d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260809-yr5dracr6x
SHA256 a7b7597406719cb7e03edff8a024039f941b689abf4767bbd2ee172a317b02b7
MD5 20b93a44f94294ec08ee31d28e51ba8d
SHA1 a3d14429e4103704d8f839b8358045f7e66b568f
SHA512 b3b4a7309f77644685863361f1b7d43f6336af22aeb4ff8d9f71e5209f293539d2f75abab5c8e5ce53eeb8368815cf1fdd4136f19fc77150e5a5fffd5e111e0f
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroy:kIAFGBIaEwK70K7W
TLSH
T1F3B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
252	yfyouyb.exe
5228	yfyouyb.exe
2036	yfyouyb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	2026-08-09_20b93a44f94294ec08ee31d28e51ba8d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	yfyouyb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
812	252	WerFault.exe	89
5928	2036	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_20b93a44f94294ec08ee31d28e51ba8d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
252	yfyouyb.exe
252	yfyouyb.exe
2036	yfyouyb.exe
2036	yfyouyb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	252	yfyouyb.exe
Token: SeDebugPrivilege	2036	yfyouyb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 252 wrote to memory of 1708	252	yfyouyb.exe	81
PID 2036 wrote to memory of 1708	2036	yfyouyb.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_20b93a44f94294ec08ee31d28e51ba8d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_20b93a44f94294ec08ee31d28e51ba8d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2692

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 252 -s 528
  2⤵
  - Program crash
  PID:812

C:\PROGRA~3\Mozilla\yfyouyb.exe
C:\PROGRA~3\Mozilla\yfyouyb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 252 -ip 252
1⤵
PID:2620

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 500
  2⤵
  - Program crash
  PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2036 -ip 2036
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yfyouyb.exe

Path C:\ProgramData\Mozilla\yfyouyb.exe
Size 107KB
SHA256 f2140f1f529957b9d15a7598c7c88f662366120b64212834aa08bb0f52c28fb7
MD5 7e5e922e00c95208ade31d5dc497b137
SHA1 cce4ac865002032a7e8e158bdc15fbd0afe8ed2c
SHA512 5439b891359f3a886d8992dac5676ee12ccc5c351956fde84d0ff072a1d3b9ab54fbb8d7f485c5dbac7d15dd721f308bd92f571328eeba6b63a5bd2c62243df7
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYrot:kIAFGBIaEwK70K75
TLSH
T142B38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yfyouyb.exe

Path C:\ProgramData\Mozilla\yfyouyb.exe
Size 107KB
SHA256 d95da056f3e1ab02ebb2dcc1e0828c4ce6fe859727520f6b083621147f3584e3
MD5 94eaf7fd59dfa812150853e265ccfb87
SHA1 efaaa9e7dcc50b9a57f7a6519d816c5fbfaa03c4
SHA512 e78c96120421827e6b1a099979150cd4d0d529cc81ca41cdd3bbe1a667e127340a3aafead4adc80ef1193bcfa2ef1e7fe3d24f8b8f59f959faf9716b5874726b
SSDEEP 3072:Z+Oa8AFG8sZI5e+MEY+BC3K5eqU+BC3K5eqYroR:kIAFGBIaEwK70K7l
TLSH
T13BB38E41F3D0DD76F05C253184A746B30AB5ED1297B125AB27883BAFDDB02A05A7AF07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-4-0x0000000004260000-0x000000000427C000-memory.dmp

Download

memory/5228-6-0x0000000000C20000-0x0000000000C7EF1C-memory.dmp

Download