ebd311041fa0e7c6fe139ead6298bf26cf57ca9c22bb2087b33d1d5c6f65b5bb

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_bfe3ed852d8163daacc8bb82cfca79f0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260813-17rtpsdg23
SHA256 ebd311041fa0e7c6fe139ead6298bf26cf57ca9c22bb2087b33d1d5c6f65b5bb
MD5 bfe3ed852d8163daacc8bb82cfca79f0
SHA1 5e51fd350a791f8252809ab78950c8aa0c2b482d
SHA512 538cdbd5204fe01e1fec25a9616c512049806010474338f89aa87c027d738cc1c4c1f36a2fd6912cef11f93e69d12b7b9b44b5bf491614489567cf4dbfac810b
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJj:mh7c54FK70K7Nj
TLSH
T11BB38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5624	yfyouyb.exe
4964	yfyouyb.exe
4824	yfyouyb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	2026-08-13_bfe3ed852d8163daacc8bb82cfca79f0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	yfyouyb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
980	5624	WerFault.exe	89
4432	4824	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_bfe3ed852d8163daacc8bb82cfca79f0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5624	yfyouyb.exe
5624	yfyouyb.exe
4824	yfyouyb.exe
4824	yfyouyb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5624	yfyouyb.exe
Token: SeDebugPrivilege	4824	yfyouyb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 5780	5624	yfyouyb.exe	82
PID 4824 wrote to memory of 5780	4824	yfyouyb.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5780
- C:\Users\Admin\AppData\Local\Temp\2026-08-13_bfe3ed852d8163daacc8bb82cfca79f0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_bfe3ed852d8163daacc8bb82cfca79f0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4148

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 528
  2⤵
  - Program crash
  PID:980

C:\PROGRA~3\Mozilla\yfyouyb.exe
C:\PROGRA~3\Mozilla\yfyouyb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 5624 -ip 5624
1⤵
PID:4916

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 500
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4824 -ip 4824
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yfyouyb.exe

Path C:\PROGRA~3\Mozilla\yfyouyb.exe
Size 106KB
SHA256 699a127a37b4eca746d8c66f23ba06562d1a1289ec9d6b2a85e0faa35b41db48
MD5 e31abfeaae231372ddb11b7a4b0956ed
SHA1 c9b906e7134bd9c7562d545d4c8c184f7fd75bdd
SHA512 a88cc1d1d284dd425764a79c2bf3d9e7753a4ae6fcc3fcb4de965931ec870738df283e63ea93ae8e9534140dc4d5dfc115b2b69292b72073f5f8b55b8e3a5cf0
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJj:mh7c54FK70K7Nj
TLSH
T138B38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yfyouyb.exe

Path C:\ProgramData\Mozilla\yfyouyb.exe
Size 106KB
SHA256 935c0697b00b6eb1020d645d1c5c1f2bf35495e6de6ed2fc3e8238e2ce6d63a8
MD5 a118deef99450d047067eb5a2402281d
SHA1 c1c5730cd32a333530ff25174ca6fc61e4fa34e5
SHA512 744fa912afa7b5dff8a06fc0eba779280b90a07bf3427626468841c7f34dd5876f9ab13f8462bf7746e7a0022b4dd42d07fda4401e759af287290dac513f5693
SSDEEP 3072:mAayGHbc59ta5L+BC3K5eqU+BC3K5eqYroJl:mh7c54FK70K7Nl
TLSH
T17BB38E41F3C0DD76E05C2531846346B20BB9ED1697B165AB17883BAFED702A05A7BF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4964-6-0x0000000000340000-0x000000000039F000-memory.dmp

Download

memory/5780-4-0x0000000002360000-0x000000000237C000-memory.dmp

Download