f926d4c8fe13279cf2baccfa6924ca324a9717a6c672e05adb3dfd2badaa0363

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260817-bdymqa1tht
SHA256 f926d4c8fe13279cf2baccfa6924ca324a9717a6c672e05adb3dfd2badaa0363
MD5 0c67c8de58f9b341699ff5ec3f957014
SHA1 868402cd6716af9f1e43353d15ddaf461f557c47
SHA512 4af2229dca0ec8fa171f493f092e3665ff1501398ee14726f8c95d09da5d30221f0ad65418e0cc44d7c86ce6da4f295fbba4f46ccd98c95ac2f2eacd311361c3
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJ7:iX9yBfYK70K7N7
TLSH
T1B1848E00F3C0DD76E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1680	fghdwaj.exe
5076	fghdwaj.exe
4756	fghdwaj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fghdwaj.exe	2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\fghdwaj.exe	fghdwaj.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1088	1680	WerFault.exe	87
1476	4756	WerFault.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fghdwaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fghdwaj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fghdwaj.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1680	fghdwaj.exe
1680	fghdwaj.exe
4756	fghdwaj.exe
4756	fghdwaj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	fghdwaj.exe
Token: SeDebugPrivilege	4756	fghdwaj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3292	1680	fghdwaj.exe	56
PID 4756 wrote to memory of 3292	4756	fghdwaj.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3292
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3444

C:\PROGRA~3\Mozilla\fghdwaj.exe
C:\PROGRA~3\Mozilla\fghdwaj.exe -smhulbi
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 504
  2⤵
  - Program crash
  PID:1088

C:\PROGRA~3\Mozilla\fghdwaj.exe
C:\PROGRA~3\Mozilla\fghdwaj.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1680 -ip 1680
1⤵
PID:1224

C:\PROGRA~3\Mozilla\fghdwaj.exe
C:\PROGRA~3\Mozilla\fghdwaj.exe -smhulbi
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 476
  2⤵
  - Program crash
  PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4756 -ip 4756
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fghdwaj.exe

Path C:\ProgramData\Mozilla\fghdwaj.exe
Size 380KB
SHA256 67a553b20017fded12eb93137fee6ad8ca79878f92720515d7cd999b885c88fd
MD5 e782176d09e703e41696d19c30698b8a
SHA1 ffa273159588b4360411459bc4a9d646d147b3b0
SHA512 76fd4cd109ead4bf70d89af5b779bf461af93a27e8e4a851c843a404bc0727e60a85e6e02184c565e6ee3ebdd497344c2e856fa0d314e3a0a1577151dc97abc2
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJN:iX9yBfYK70K7NN
TLSH
T104848E00F3C0DD77E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fghdwaj.exe

Path C:\ProgramData\Mozilla\fghdwaj.exe
Size 380KB
SHA256 9421035159cca3c4faa4306cfdb4548d8b9dbac1dc41ad16f183ce32f3341987
MD5 938c7df1f4334d690217794f6943247c
SHA1 c1b21302e2c311b03a1414b77fdbe216ff87938a
SHA512 3dfcd95a625badbf3f23f6b16de0bbae18813ef63ce77f7dc9665e38be79baa8254317c9aa4ec8594a1ec073294dcdc25e5d551276f7fd264adbd985aa42cf14
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJ5:iX9yBfYK70K7N5
TLSH
T145848E00F3C0DD77E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-4-0x00000000026F0000-0x000000000270C000-memory.dmp

Download

memory/5076-7-0x0000000000DC0000-0x0000000000E1F000-memory.dmp

Download