f926d4c8fe13279cf2baccfa6924ca324a9717a6c672e05adb3dfd2badaa0363

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
Size 380KB
Sample260817-bdymqa1tht
SHA256 f926d4c8fe13279cf2baccfa6924ca324a9717a6c672e05adb3dfd2badaa0363
MD5 0c67c8de58f9b341699ff5ec3f957014
SHA1 868402cd6716af9f1e43353d15ddaf461f557c47
SHA512 4af2229dca0ec8fa171f493f092e3665ff1501398ee14726f8c95d09da5d30221f0ad65418e0cc44d7c86ce6da4f295fbba4f46ccd98c95ac2f2eacd311361c3
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJ7:iX9yBfYK70K7N7
TLSH
T1B1848E00F3C0DD76E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2912	mqagayh.exe
5344	mqagayh.exe
696	mqagayh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\mqagayh.exe	2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\mqagayh.exe	mqagayh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
748	2912	WerFault.exe	89
424	696	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mqagayh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2912	mqagayh.exe
2912	mqagayh.exe
696	mqagayh.exe
696	mqagayh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	mqagayh.exe
Token: SeDebugPrivilege	696	mqagayh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 4648	2912	mqagayh.exe	82
PID 696 wrote to memory of 4648	696	mqagayh.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:4648
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0c67c8de58f9b341699ff5ec3f957014_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3860

C:\PROGRA~3\Mozilla\mqagayh.exe
"C:\PROGRA~3\Mozilla\mqagayh.exe" -romcaej
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 528
  2⤵
  - Program crash
  PID:748

C:\PROGRA~3\Mozilla\mqagayh.exe
C:\PROGRA~3\Mozilla\mqagayh.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2912 -ip 2912
1⤵
PID:5940

C:\PROGRA~3\Mozilla\mqagayh.exe
"C:\PROGRA~3\Mozilla\mqagayh.exe" -romcaej
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 512
  2⤵
  - Program crash
  PID:424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 696 -ip 696
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mqagayh.exe

Path C:\ProgramData\Mozilla\mqagayh.exe
Size 380KB
SHA256 5eb7c10c78707ffee1c56445f83eae1d0d6f4b06134ddf4010c42425feb98477
MD5 79141835c6d1a963f8d0ea4ce141f2e5
SHA1 320320031c832d5456c11a55fe5b12a0914d3b97
SHA512 7a3cac0ce590f814d209e5c33e6dadfdf70a4ee91c97303cde2c59f3fcadaa48c8606807eb9907cf842ae96d31b0bc3966db912ab93c97e6a632c71c5a00391e
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJH:iX9yBfYK70K7NH
TLSH
T1ED848E00F3C0DD77E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mqagayh.exe

Path C:\ProgramData\Mozilla\mqagayh.exe
Size 380KB
SHA256 0598ac2fd2692c3db750ff2a9287153f1fddcfe2e724d2ba1b7eddd7cda7d785
MD5 60a8a89b3e7b773d2c01f7a8fdcb64a9
SHA1 242276fa24544f1fee3e5e68e376fc085f718a8b
SHA512 bbf6a304c647140de920e0876cf9301c9259594ad3e8993379daa55fe717f0035da48cb28f752d7a47d59ded91136161b36802877deb0bb4def2cefee9095551
SSDEEP 3072:ixaepXyBfk9D9+BC3K5eqU+BC3K5eqYroJb:iX9yBfYK70K7Nb
TLSH
T1BB848E00F3C0DD77E16C2535C4A346A20B79FD1697A165AB17982FAFDCB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4648-4-0x0000000000820000-0x000000000083C000-memory.dmp

Download

memory/5344-6-0x00000000006B0000-0x000000000070F000-memory.dmp

Download