414abbb5ca5c4db420260480b718c532c0ebf4b59108a3bfb955a6309e1c77df

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260822-xp5fasyblh
SHA256 414abbb5ca5c4db420260480b718c532c0ebf4b59108a3bfb955a6309e1c77df
MD5 0ff785edb9c574fc7fa3e4e551b3f462
SHA1 539f2b4fcfe2ab9d4454b2c5241f9c71d046cc91
SHA512 722aba4125d1aa9769c584c798921dba03ba2f9fa6e2d9440641142df600a49f3f761fbc6d4482470b5cc7bfb906228c4604f921ef0ad9d87521a5a4a96324fc
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJ4:mh7c5dFK70K7N4
TLSH
T172B38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4208	vcgxqhd.exe
4908	vcgxqhd.exe
1684	vcgxqhd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\vcgxqhd.exe	2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\vcgxqhd.exe	vcgxqhd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1672	4208	WerFault.exe	86
3408	1684	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vcgxqhd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4208	vcgxqhd.exe
4208	vcgxqhd.exe
1684	vcgxqhd.exe
1684	vcgxqhd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4208	vcgxqhd.exe
Token: SeDebugPrivilege	1684	vcgxqhd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3136	4208	vcgxqhd.exe	56
PID 1684 wrote to memory of 3136	1684	vcgxqhd.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3136
- C:\Users\Admin\AppData\Local\Temp\2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3896

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe -zoiucwg
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 504
  2⤵
  - Program crash
  PID:1672

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4208 -ip 4208
1⤵
PID:2264

C:\PROGRA~3\Mozilla\vcgxqhd.exe
C:\PROGRA~3\Mozilla\vcgxqhd.exe -zoiucwg
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 484
  2⤵
  - Program crash
  PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1684 -ip 1684
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcgxqhd.exe

Path C:\ProgramData\Mozilla\vcgxqhd.exe
Size 106KB
SHA256 cc7679d0ee98f381989d2c0a2b10fde7a21b9629ea11ea141c5bffb44b556bf3
MD5 7b67b1909268bd9f69df0d0cfba8202c
SHA1 07ac2be44980859959ead628a27e50b9bfc8c05d
SHA512 3c6dd28bd74a335c419484a6209582998b1a6b050c73fd9537b0e6c84ed5088c25b27c72653c9990a804aec232958339ee6c17b8e1b24e5d3024c7d6cac6cf06
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJE:mh7c5dFK70K7NE
TLSH
T1F6B38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcgxqhd.exe

Path C:\ProgramData\Mozilla\vcgxqhd.exe
Size 106KB
SHA256 bfb48e81920c169b865c9f3a00887c1be8e71b97134887713a24e6ebf1abd0a6
MD5 2dcea354d83416afe56cd7bab0bf6cd8
SHA1 69987fd91555ca1e3f18cac0bb5519ca9e950e28
SHA512 d8013f619b7df6f1183bbb7ea080a8e6f6d0fd3bfeb31b2c59a20815444780193426a4047da27a1fe7708fd0c34c6a43e774033498391147af0b25087ddabaf0
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJ4:mh7c5dFK70K7N4
TLSH
T1CDB38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3136-4-0x0000000002780000-0x000000000279C000-memory.dmp

Download

memory/4908-6-0x0000000000040000-0x000000000009F000-memory.dmp

Download