414abbb5ca5c4db420260480b718c532c0ebf4b59108a3bfb955a6309e1c77df

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 106KB
Sample260822-xp5fasyblh
SHA256 414abbb5ca5c4db420260480b718c532c0ebf4b59108a3bfb955a6309e1c77df
MD5 0ff785edb9c574fc7fa3e4e551b3f462
SHA1 539f2b4fcfe2ab9d4454b2c5241f9c71d046cc91
SHA512 722aba4125d1aa9769c584c798921dba03ba2f9fa6e2d9440641142df600a49f3f761fbc6d4482470b5cc7bfb906228c4604f921ef0ad9d87521a5a4a96324fc
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJ4:mh7c5dFK70K7N4
TLSH
T172B38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4264	ggnrhdc.exe
3620	ggnrhdc.exe
108	ggnrhdc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ggnrhdc.exe	2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\ggnrhdc.exe	ggnrhdc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5328	4264	WerFault.exe	89
2284	108	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggnrhdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggnrhdc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ggnrhdc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4264	ggnrhdc.exe
4264	ggnrhdc.exe
108	ggnrhdc.exe
108	ggnrhdc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4264	ggnrhdc.exe
Token: SeDebugPrivilege	108	ggnrhdc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5044	4264	ggnrhdc.exe	82
PID 108 wrote to memory of 5044	108	ggnrhdc.exe	82

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5044
- C:\Users\Admin\AppData\Local\Temp\2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-21_0ff785edb9c574fc7fa3e4e551b3f462_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4140

C:\PROGRA~3\Mozilla\ggnrhdc.exe
"C:\PROGRA~3\Mozilla\ggnrhdc.exe" -iqdjgfd
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4264 -s 528
  2⤵
  - Program crash
  PID:5328

C:\PROGRA~3\Mozilla\ggnrhdc.exe
C:\PROGRA~3\Mozilla\ggnrhdc.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4264 -ip 4264
1⤵
PID:3288

C:\PROGRA~3\Mozilla\ggnrhdc.exe
"C:\PROGRA~3\Mozilla\ggnrhdc.exe" -iqdjgfd
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 512
  2⤵
  - Program crash
  PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 108 -ip 108
1⤵
PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ggnrhdc.exe

Path C:\ProgramData\Mozilla\ggnrhdc.exe
Size 106KB
SHA256 b84cb91a7727d96156066f889abd18941f7d4b51cd47d8045531ba628f532635
MD5 2f9e74db368a0d2cf9915f49a0564041
SHA1 c0a33a5f3eebab8145c8ea15979967df855fae22
SHA512 768a00e4796d4e3f12f3fed9fc66702f4c42a66723a9d902ec565bd7a48fbb9d71f3e7f50655452c9ef32290598bc82df9ec53e104be4997fc5e66dda25ad711
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJF:mh7c5dFK70K7NF
TLSH
T1CAB38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggnrhdc.exe

Path C:\ProgramData\Mozilla\ggnrhdc.exe
Size 106KB
SHA256 0ab68c2f9fe4cdd0a0d73f91f858797b0097c82e17f360bb3e6fa10ba0196642
MD5 73143521cb11f74d75bc804eb4c3e59a
SHA1 08cbc855a80422c9b975d68cf733f18c4eb61a57
SHA512 09bde0df9fa493f523904c117144caaa9420586ac597cfc2d810469a09c021625e26df890d8597f79a1f8cd96ce4dd548fd02b65897b96f5606dfe5e590be7f8
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJz:mh7c5dFK70K7Nz
TLSH
T1A5B38E41F3C0DD76E05C2531846346B20BB5ED16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3620-6-0x0000000000D20000-0x0000000000D7F000-memory.dmp

Download

memory/5044-4-0x0000000003100000-0x000000000311C000-memory.dmp

Download