267e58186541fa7aa8bdabd83d2b0091d57817b6f0e04c0c111d61b1522e2402

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_2b462e71f1466e1d4f6661ceb771b32f_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260811-zzptpsdk8w
SHA256 267e58186541fa7aa8bdabd83d2b0091d57817b6f0e04c0c111d61b1522e2402
MD5 2b462e71f1466e1d4f6661ceb771b32f
SHA1 a5cc24a7315784adbf4e4f634238457d00d08d12
SHA512 2f639142eeda6481f164345f0f137476bf0cffa09e90ecf692dfffae7466837df2dd7dc14ede2b8be3146f7e24095721af56308e099ebdd0b1c79ee4128a0c49
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYro1:ARBuA6AIIK70K75
TLSH
T1F8848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4744	eviklle.exe
1028	eviklle.exe
1344	eviklle.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\eviklle.exe	2026-08-11_2b462e71f1466e1d4f6661ceb771b32f_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\eviklle.exe	eviklle.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4620	4744	WerFault.exe	89
2592	1344	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_2b462e71f1466e1d4f6661ceb771b32f_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eviklle.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4744	eviklle.exe
4744	eviklle.exe
1344	eviklle.exe
1344	eviklle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	eviklle.exe
Token: SeDebugPrivilege	1344	eviklle.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2384	4744	eviklle.exe	81
PID 1344 wrote to memory of 2384	1344	eviklle.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2384
- C:\Users\Admin\AppData\Local\Temp\2026-08-11_2b462e71f1466e1d4f6661ceb771b32f_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-11_2b462e71f1466e1d4f6661ceb771b32f_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2692

C:\PROGRA~3\Mozilla\eviklle.exe
"C:\PROGRA~3\Mozilla\eviklle.exe" -zjllbpk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 528
  2⤵
  - Program crash
  PID:4620

C:\PROGRA~3\Mozilla\eviklle.exe
C:\PROGRA~3\Mozilla\eviklle.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4744 -ip 4744
1⤵
PID:2192

C:\PROGRA~3\Mozilla\eviklle.exe
"C:\PROGRA~3\Mozilla\eviklle.exe" -zjllbpk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 512
  2⤵
  - Program crash
  PID:2592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1344 -ip 1344
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eviklle.exe

Path C:\ProgramData\Mozilla\eviklle.exe
Size 380KB
SHA256 01611cc51158c15b48ad1baaef2093638696a06e93e5cdd4c78541c19175ad60
MD5 7b399f63d664b919122043345abd4efd
SHA1 9e1d7c103115d683a6689a50a25210277e34b183
SHA512 b5f14e14ebae346286b5db9d32ac4f94b2fd952feec36b7d494efb98b0eabef73cf95abeb1c61b1ab60bf4ca9e8881bf1a3dda07fdd7a997065c9f7efa6b9023
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroz:ARBuA6AIIK70K7/
TLSH
T1D1848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eviklle.exe

Path C:\ProgramData\Mozilla\eviklle.exe
Size 380KB
SHA256 11a391c1a44d10725c8e4c3ef6b736f71a2dc4830ef123ce3ad3cb2d96ccab03
MD5 9efd10f63934b3baf65daf6e78804bd2
SHA1 60ab3cd399d5d158e4dea7d5e7476b718e7055c5
SHA512 f3183e8b93541394e777f9136e6ff9e614ca66f4cc4888cbb8bb255cd244fd93ba87aca199243091af40351ec36d79528d76af22912a34e5184c88ce9bcd833c
SSDEEP 3072:leMavBuAq9SZI5e9d+BC3K5eqU+BC3K5eqYroN:ARBuA6AIIK70K7x
TLSH
T1B6848D41B3D0DD76F06C253180A386720BB9EC0597B125AB279C3BAFDDB02A15A76F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-8-0x0000000000360000-0x00000000003BEF1C-memory.dmp

Download

memory/2384-6-0x0000000001030000-0x000000000104C000-memory.dmp

Download

memory/2692-0-0x0000000000A58000-0x0000000000A59000-memory.dmp

Download

memory/4744-4-0x0000000000368000-0x0000000000369000-memory.dmp

Download