19b538cbb2b3bee31c328a6740c5417057cf826b3b0891f1f58cd0ac49bcc327

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_999d8cde75fc1e16f0be89967c606547_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample260812-13mn7afa96
SHA256 19b538cbb2b3bee31c328a6740c5417057cf826b3b0891f1f58cd0ac49bcc327
MD5 999d8cde75fc1e16f0be89967c606547
SHA1 9520afb26ebad85538ebfc5c48d9be7b9b7a5731
SHA512 89e2f1aca0296a7325e1a8432d143eddfd93f81506f714f900330dbb58af3fd0444589163dd3d01dc04179706be8a02a05e25b216dc3ca463ba78d636424419d
SSDEEP 3072:l+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYror:gIAFGWIaDK70K7P
TLSH
T10AB38D41B3D0DD66E05C253184A746B20BB5EC1597B135AB27883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1196	mqagayh.exe
4552	mqagayh.exe
3176	mqagayh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\mqagayh.exe	2026-08-12_999d8cde75fc1e16f0be89967c606547_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\mqagayh.exe	mqagayh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1000	1196	WerFault.exe	89
5328	3176	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_999d8cde75fc1e16f0be89967c606547_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1196	mqagayh.exe
1196	mqagayh.exe
3176	mqagayh.exe
3176	mqagayh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1196	mqagayh.exe
Token: SeDebugPrivilege	3176	mqagayh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3540	1196	mqagayh.exe	80
PID 3176 wrote to memory of 3540	3176	mqagayh.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:3540
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_999d8cde75fc1e16f0be89967c606547_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_999d8cde75fc1e16f0be89967c606547_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5344

C:\PROGRA~3\Mozilla\mqagayh.exe
"C:\PROGRA~3\Mozilla\mqagayh.exe" -romcaej
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 468
  2⤵
  - Program crash
  PID:1000

C:\PROGRA~3\Mozilla\mqagayh.exe
C:\PROGRA~3\Mozilla\mqagayh.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1196 -ip 1196
1⤵
PID:6124

C:\PROGRA~3\Mozilla\mqagayh.exe
"C:\PROGRA~3\Mozilla\mqagayh.exe" -romcaej
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 500
  2⤵
  - Program crash
  PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3176 -ip 3176
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mqagayh.exe

Path C:\ProgramData\Mozilla\mqagayh.exe
Size 107KB
SHA256 1e162bded964549fa23995d277463d0d5bf09d18c3993ec3aca39df022165ea7
MD5 4f5ec465f927a27bd757f79c41256b5b
SHA1 3972847d920cb58c26fc5e587d6262e15209c320
SHA512 ba148d50506559a0c6bce5db3539f7b9a5feda36338573df848ddae3e488a20be9cf5e09e324fc49f863f0509b70a96546de00254a69fad6a9f0e5902c527a20
SSDEEP 3072:l+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYrog:gIAFGWIaDK70K70
TLSH
T1B0B38D41B3D0DD66F05C253184A746B30BB5EC1597B135AB27883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mqagayh.exe

Path C:\ProgramData\Mozilla\mqagayh.exe
Size 107KB
SHA256 a83add4928a54cf214d426b4949c50df20c780e441d5e7b4cd574de7bee26ecc
MD5 a4f3186eb11b9b07d41a5f9c47c6545e
SHA1 320ac52748c95b66f8b621e7a8264a98701fe524
SHA512 02825b98b923ff5ca510d79cc7c03636f7715737417e4fce632ae64b15bed09ed0979a13fb3b895ede2b84cb87c077ae620488af6c4945284b9eb561dde723bb
SSDEEP 3072:l+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYroy:gIAFGWIaDK70K7u
TLSH
T127B38D41B3D0DD66F05C253184A746B30BB5EC1597B135AB27883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-4-0x00000000002E0000-0x0000000000340000-memory.dmp

Download

memory/1196-9-0x00000000002E0000-0x0000000000340000-memory.dmp

Download

memory/3176-14-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3176-16-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3540-8-0x00000000012A0000-0x00000000012BC000-memory.dmp

Download

memory/4552-7-0x00000000002E0000-0x0000000000340000-memory.dmp

Download

memory/4552-12-0x00000000002E0000-0x0000000000340000-memory.dmp

Download

memory/5344-0-0x00000000005E0000-0x0000000000640000-memory.dmp

Download

memory/5344-2-0x00000000005E0000-0x0000000000640000-memory.dmp

Download