Overview

overview

7

Static

static

3

2026-08-12...op.exe

windows10-2004-x64

7

2026-08-12...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/08/2026, 08:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-12_82386fee676f28df614cdf9aeb516a5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
  • Size 25.5MB
  • Sample260812-kkhphsserg
  • SHA256 adc26119aff7de9112bced138270dd8b4f0ddfc43dfeaee2d7adb16a36451e7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-12_82386fee676f28df614cdf9aeb516a5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-12_82386fee676f28df614cdf9aeb516a5e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C5FBDC2360AC2AB16F14E8BB05CAB2EF C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2220

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PrepareDlgProgress.gif
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\PrepareDlgProgress.gif
        • Size 27KB
        • SHA256 fd488abbdc8fee0339b679324332a3af29db00f782d635e2a6593a4140a60ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        background
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\background
        • Size 154B
        • SHA256 fe7c2d4c244139591b0b716a410a1d8af38084cdc560a2beb265bdb8578e4eb3
        • MD5 SHA1 SHA512
        Submit Download

        frame_right.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\frame_right.bmp
        • Size 66B
        • SHA256 3e57878d7e1c0d2fe4db1dd47b803a363188114520ff5d7a4f50fab47c0ee992
        • MD5 SHA1 SHA512
        Submit Download

        frame_top_left.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\frame_top_left.bmp
        • Size 154B
        • SHA256 a7d431d251af68b816cb7e94e05b2201f24ebce1ccc01a39fcd5c0efcc0d03c4
        • MD5 SHA1 SHA512
        Submit Download

        frame_top_mid.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\frame_top_mid.bmp
        • Size 66B
        • SHA256 e4ab79b964317d20d8e15d8723cadca3691878520cfe498eb62674fd8e4a3dc2
        • MD5 SHA1 SHA512
        Submit Download

        lpboxinstaller.jpg_1
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\lpboxinstaller.jpg_1
        • Size 3KB
        • SHA256 ab639ac09fc86748374dff82b0aeb8c2d7611c715f219b6d43d21b97d05a9245
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        nextcancelbuttons
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\nextcancelbuttons
        • Size 405B
        • SHA256 8d9aa1ddf1b98a6fac56d878fc1bee87bf6eeefd291fc849e3efc5242bc19016
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sys_close_normal.png
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_4492\sys_close_normal.png
        • Size 225B
        • SHA256 bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        MSIFBC1.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSIFBC1.tmp
        • Size 76KB
        • SHA256 32b5fd4c987c3b481945de78e7cbc63346bb4d4d4ffce20ffeb19fb7b23408b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        lp4-release4.msi
        • Path C:\Users\Admin\AppData\Roaming\Mirage Computer Systems\Licence Protector 4.0.911\install\lp4-release4.msi
        • Size 1.7MB
        • SHA256 ec732fd0c48893a6da80d24998994359db1e473eca9ebcfbfaf5b8a949254431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4492-0-0x00000000028A0000-0x00000000028A1000-memory.dmp
        Download