6edfcc1c4d09708d346dfba95c82d867ff04b073863120284c2a56c955324ee8

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_06907a592d436d237cf7cfdb6e3e5862_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260813-cdarbszbre
SHA256 6edfcc1c4d09708d346dfba95c82d867ff04b073863120284c2a56c955324ee8
MD5 06907a592d436d237cf7cfdb6e3e5862
SHA1 ef53960b5adcbc4227ac7cb917ff0ca0f723a132
SHA512 85ea9be82ca12af5c8760cb53d77d48149d2d875c2c35197784edb854ddb15da937611e361f142c8787a79b8c507a2e4b1583364977a9a12c2596a5c27be32a4
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJY:iX9yBfYK70K7NY
TLSH
T194848E00F3C0DD76E16C2535C4A346B20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
256	yfyouyb.exe
3712	yfyouyb.exe
3340	yfyouyb.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	2026-08-12_06907a592d436d237cf7cfdb6e3e5862_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\yfyouyb.exe	yfyouyb.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2112	256	WerFault.exe	89
5496	3340	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_06907a592d436d237cf7cfdb6e3e5862_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yfyouyb.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
256	yfyouyb.exe
256	yfyouyb.exe
3340	yfyouyb.exe
3340	yfyouyb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	256	yfyouyb.exe
Token: SeDebugPrivilege	3340	yfyouyb.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 1708	256	yfyouyb.exe	81
PID 3340 wrote to memory of 1708	3340	yfyouyb.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1708
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_06907a592d436d237cf7cfdb6e3e5862_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-12_06907a592d436d237cf7cfdb6e3e5862_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2060

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 256 -s 528
  2⤵
  - Program crash
  PID:2112

C:\PROGRA~3\Mozilla\yfyouyb.exe
C:\PROGRA~3\Mozilla\yfyouyb.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 256 -ip 256
1⤵
PID:6120

C:\PROGRA~3\Mozilla\yfyouyb.exe
"C:\PROGRA~3\Mozilla\yfyouyb.exe" -vvzltsn
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 440
  2⤵
  - Program crash
  PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3340 -ip 3340
1⤵
PID:2944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yfyouyb.exe

Path C:\ProgramData\Mozilla\yfyouyb.exe
Size 380KB
SHA256 4f05674ec94fc5f17b0abb87f40f22050aef2c2e4b6f31ca5ea0ed0bbe2d32ea
MD5 b64bb2ba3f5b6fa358de62c1c4548c87
SHA1 dfbdb77b9675d62e6450a7294258fba4ede08321
SHA512 d6269d156427c75bcdac56d5c19544d3ac575529d58847e771e62de338f805c3cc352dcf82bb7a9fe7239b02e764eb14429dadc7869dcb97f6752ff7f888784d
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJz:iX9yBfYK70K7Nz
TLSH
T11D848E00F3C0DD76E16C2535C4A346B20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yfyouyb.exe

Path C:\ProgramData\Mozilla\yfyouyb.exe
Size 380KB
SHA256 a1e05180c14776359bdef3a0b2bd1f955ca6bd21bcf54dda4caeb65fd56354df
MD5 014a5b8b951a5e8fca5017172f4a7ced
SHA1 71a7a8bef1490ad8687d982b2cd6b56debeaf4b4
SHA512 1dc0c49f913421c8a2151ab2d64874bbd82f3f3f902ad61fb0b3c32e837fe9896844ca3ef3c505cc8ef47073d602fbae9f284f7b7cc290ccef2e626ffcc9e2c8
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJI:iX9yBfYK70K7NI
TLSH
T11B848E00F3C0DD76E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-4-0x0000000004260000-0x000000000427C000-memory.dmp

Download

memory/3712-6-0x00000000004E0000-0x000000000053F000-memory.dmp

Download