Overview

overview

10

Static

static

3

2026-08-19...yn.exe

windows10-2004-x64

10

2026-08-19...yn.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe
  • Size 13.2MB
  • Sample260819-gef2ysdc49
  • SHA256 0ac7de7e102d2a97f879f54a06b00ea478124728e19a1d7507dea2748d125eff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionpersistenceransomware

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
    ransomwareevasion
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3028
    • \??\c:\users\admin\appdata\local\temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Windows\SYSTEM32\cmd.exe
        cmd.exe /c bcdedit.exe > "C:\Users\Admin\AppData\Local\Temp\usb8028.tmp"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe
          4⤵
            PID:2476
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set testsigning on
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:1156
        • C:\Windows\SysWOW64\msiexec.exe
          msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi" REBOOTNEEDED=1
          3⤵
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3584
      • C:\Windows\Resources\Themes\icsys.icn.exe
        C:\Windows\Resources\Themes\icsys.icn.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3760
        • \??\c:\windows\resources\themes\explorer.exe
          c:\windows\resources\themes\explorer.exe
          3⤵
          • Modifies visibility of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3476
          • \??\c:\windows\resources\spoolsv.exe
            c:\windows\resources\spoolsv.exe SE
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1608
            • \??\c:\windows\resources\svchost.exe
              c:\windows\resources\svchost.exe
              5⤵
              • Modifies visibility of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2388
              • \??\c:\windows\resources\spoolsv.exe
                c:\windows\resources\spoolsv.exe PR
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:4072
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding AB8B969D343C0971F62D66E67EA69A59 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCB29BB1-8C87-4980-8E58-3155B8CCA2F9}
          3⤵
          • Executes dropped EXE
          PID:3808
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA0056B7-4B6A-4BC2-AE55-B0371170EE28}
          3⤵
          • Executes dropped EXE
          PID:2064
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D17FFE38-2D41-4C06-A7D5-A86052FA306A}
          3⤵
          • Executes dropped EXE
          PID:448
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14FEB3DA-502B-44F0-AE46-0CCFBA016981}
          3⤵
          • Executes dropped EXE
          PID:4816
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F87982A5-5B42-4C05-87A2-654E1E7A51B0}
          3⤵
          • Executes dropped EXE
          PID:2808
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{37094946-1976-48EF-92D1-22569516A706}
          3⤵
          • Executes dropped EXE
          PID:1824
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{43A3158D-FF44-47F1-896A-311DF5B44966}
          3⤵
          • Executes dropped EXE
          PID:4416
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C7EEA819-7DF3-4A9A-A6AC-9E0CBEC1FC08}
          3⤵
          • Executes dropped EXE
          PID:2636
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F46C3593-CCE3-43AF-807F-CEFF4BFF1258}
          3⤵
          • Executes dropped EXE
          PID:4472
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9E1EB69B-3A35-4410-8E92-6203194D641D}
          3⤵
          • Executes dropped EXE
          PID:1220
        • C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B0FFFEEF-FFBB-4818-8D63-78F85EA91886}
          3⤵
          • Executes dropped EXE
          PID:3836

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
          • Path C:\Users\Admin\AppData\Local\Temp\2026-08-19_55b25cf2edeb01a887103c3e7ad39624_darkgate_elex_rhadamanthys_smoke-loader_swisyn.exe 
          • Size 13.0MB
          • SHA256 08e5e7e5f30801b363f08a6106425faa1c505bd048a18c846a5b3e5959a4998e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI8D47.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI8D47.tmp
          • Size 1.3MB
          • SHA256 c73541a041134a4e9d7e9e5f68aef83fa3f6caad9e9b44b7cba52cd5441a38de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QualcommWindowsDriverInstaller.msi
          • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
          • Size 11.6MB
          • SHA256 ec29ea59edf79119f5cb06fc7e742cd191652e2afebb223d94a98b38dc7c3c5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          usb8028.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\usb8028.tmp
          • Size 1KB
          • SHA256 1c9a1abc3509bb21e1b0117c5505d0ce8aa42bbebcb695cec16a72b669da9ddc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ISBEW64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISBEW64.exe
          • Size 146KB
          • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ISRT.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\ISRT.dll
          • Size 260KB
          • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _isres_0x0409.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{D2EE3A10-35FB-493E-A903-AE046FE3CF7D}\_isres_0x0409.dll
          • Size 540KB
          • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          explorer.exe
          • Path C:\Windows\Resources\Themes\explorer.exe
          • Size 135KB
          • SHA256 4e39a03b7ebef3591574fb9d59916da67e10d309c63e82ba064962bdfa19991e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icsys.icn.exe
          • Path C:\Windows\Resources\Themes\icsys.icn.exe
          • Size 135KB
          • SHA256 c3e0a78eb667480abdc3423e27dcf4da4cfa6e2265ec7196ba759f55d169f6df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          spoolsv.exe
          • Path C:\Windows\Resources\spoolsv.exe
          • Size 135KB
          • SHA256 0dae64e1779c95946c9b33d6c81f3b05bb0393c6ffbd54de711849c001c5ad71
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          svchost.exe
          • Path C:\Windows\Resources\svchost.exe
          • Size 135KB
          • SHA256 a65cc3a45757d30a53f7247708083905af9f546530334a75eee911d7d7693aca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1608-96-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2388-87-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2388-103-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/2680-100-0x0000000010000000-0x00000000101B5000-memory.dmp
          Download

          memory/2680-17-0x0000000010000000-0x00000000101B5000-memory.dmp
          Download

          memory/2680-44-0x00000000031C0000-0x0000000003249000-memory.dmp
          Download

          memory/2680-39-0x00000000030D0000-0x0000000003177000-memory.dmp
          Download

          memory/2680-101-0x00000000030D0000-0x0000000003177000-memory.dmp
          Download

          memory/3028-0-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3028-98-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3476-102-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/3760-97-0x0000000000400000-0x000000000041F000-memory.dmp
          Download

          memory/4072-95-0x0000000000400000-0x000000000041F000-memory.dmp
          Download