Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
05/09/2026, 14:17
General
- Target 2026-09-04_36db701734f98015e2d3c73690387041_darkgate_elex_rhadamanthys_stop.exe
- Size 1.8MB
- Sample260905-rlw2vswfma
- SHA256 af8ff40770dff6e86c5d5590a997f2b65bfeed5efd2f4d2b818a9647e360cbb9
Malware Config
Signatures
- Executes dropped EXE 22 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 24 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_36db701734f98015e2d3c73690387041_darkgate_elex_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_36db701734f98015e2d3c73690387041_darkgate_elex_rhadamanthys_stop.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"2⤵
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 3024 3016 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 952 2992 3040 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
ArmReport.ini
ArmUI.ini
Tmp500A.tmp
Tmp77A9.tmp
Tmp7950.tmp
Tmp849B.tmp
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/552-15-0x00007FF6F5F70000-0x00007FF6F6093000-memory.dmp
memory/552-135-0x00007FF6F5F70000-0x00007FF6F6093000-memory.dmp
memory/552-16-0x000001E216F10000-0x000001E216F76000-memory.dmp
memory/552-18-0x000001E216F10000-0x000001E216F76000-memory.dmp
memory/552-17-0x000001E216F10000-0x000001E216F76000-memory.dmp
memory/756-218-0x00007FF778750000-0x00007FF77886A000-memory.dmp
memory/756-159-0x00007FF778750000-0x00007FF77886A000-memory.dmp
memory/756-160-0x00000230AB6F0000-0x00000230AB756000-memory.dmp
memory/756-161-0x00000230AB6F0000-0x00000230AB756000-memory.dmp
memory/1196-172-0x000001821CE30000-0x000001821CE96000-memory.dmp
memory/1196-171-0x000001821CC50000-0x000001821CCE5000-memory.dmp
memory/1196-173-0x000001821CE30000-0x000001821CE96000-memory.dmp
memory/1688-475-0x00007FF7C3B60000-0x00007FF7C3E9F000-memory.dmp
memory/1688-501-0x00007FF7C3B60000-0x00007FF7C3E9F000-memory.dmp
memory/1688-474-0x0000021C42410000-0x0000021C42476000-memory.dmp
memory/1688-476-0x0000021C42410000-0x0000021C42476000-memory.dmp
memory/1732-189-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1732-239-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1732-195-0x0000000000940000-0x00000000009A9000-memory.dmp
memory/1732-190-0x0000000000940000-0x00000000009A9000-memory.dmp
memory/2280-138-0x000001E711550000-0x000001E7115E5000-memory.dmp
memory/2280-139-0x000001E711710000-0x000001E711776000-memory.dmp
memory/2280-140-0x000001E711710000-0x000001E711776000-memory.dmp
memory/2476-333-0x00007FF6D6400000-0x00007FF6D668B000-memory.dmp
memory/2476-290-0x00007FF6D6400000-0x00007FF6D668B000-memory.dmp
memory/2476-291-0x000002389FCB0000-0x000002389FD16000-memory.dmp
memory/2476-292-0x000002389FCB0000-0x000002389FD16000-memory.dmp
memory/2556-202-0x00007FF650640000-0x00007FF650D84000-memory.dmp
memory/2556-203-0x00000249834E0000-0x0000024983546000-memory.dmp
memory/2556-201-0x00000249834E0000-0x0000024983546000-memory.dmp
memory/2556-502-0x00007FF650640000-0x00007FF650D84000-memory.dmp
memory/2556-256-0x00007FF650640000-0x00007FF650D84000-memory.dmp
memory/2556-500-0x00000249834E0000-0x0000024983546000-memory.dmp
memory/2880-209-0x00007FF7D9740000-0x00007FF7D97EE000-memory.dmp
memory/2880-287-0x00007FF7D9740000-0x00007FF7D97EE000-memory.dmp
memory/2880-211-0x00000209F5CF0000-0x00000209F5D56000-memory.dmp
memory/2880-210-0x00000209F5CF0000-0x00000209F5D56000-memory.dmp
memory/3080-130-0x000002102BA20000-0x000002102BA86000-memory.dmp
memory/3080-129-0x000002102B870000-0x000002102B905000-memory.dmp
memory/3080-131-0x000002102BA20000-0x000002102BA86000-memory.dmp
memory/3260-183-0x000001C37BE60000-0x000001C37BEC6000-memory.dmp
memory/3260-229-0x00007FF7E4D50000-0x00007FF7E4E9A000-memory.dmp
memory/3260-182-0x000001C37BE60000-0x000001C37BEC6000-memory.dmp
memory/3260-180-0x00007FF7E4D50000-0x00007FF7E4E9A000-memory.dmp
memory/3276-146-0x00007FF670BE0000-0x00007FF670CA9000-memory.dmp
memory/3276-112-0x0000015DB0B00000-0x0000015DB0B66000-memory.dmp
memory/3276-111-0x00007FF670BE0000-0x00007FF670CA9000-memory.dmp
memory/3276-113-0x0000015DB0B00000-0x0000015DB0B66000-memory.dmp
memory/3276-114-0x0000015DB0B00000-0x0000015DB0B66000-memory.dmp
memory/3780-147-0x00007FF66DA10000-0x00007FF66DB78000-memory.dmp
memory/3780-148-0x000001F186B60000-0x000001F186BC6000-memory.dmp
memory/3780-149-0x000001F186B60000-0x000001F186BC6000-memory.dmp
memory/3780-154-0x000001F186B60000-0x000001F186BC6000-memory.dmp
memory/3780-156-0x00007FF66DA10000-0x00007FF66DB78000-memory.dmp
memory/3800-231-0x000001FDC4BD0000-0x000001FDC4C36000-memory.dmp
memory/3800-307-0x00007FF6C5520000-0x00007FF6C55D4000-memory.dmp
memory/3800-230-0x00007FF6C5520000-0x00007FF6C55D4000-memory.dmp
memory/3800-232-0x000001FDC4BD0000-0x000001FDC4C36000-memory.dmp
memory/3884-323-0x0000020D92A40000-0x0000020D92AA6000-memory.dmp
memory/3884-493-0x00007FF688710000-0x00007FF68883F000-memory.dmp
memory/3884-324-0x0000020D92A40000-0x0000020D92AA6000-memory.dmp
memory/3884-322-0x00007FF688710000-0x00007FF68883F000-memory.dmp
memory/4552-240-0x00007FF64D120000-0x00007FF64D3C3000-memory.dmp
memory/4552-317-0x00007FF64D120000-0x00007FF64D3C3000-memory.dmp
memory/4552-242-0x000001E6F7610000-0x000001E6F7676000-memory.dmp
memory/4552-241-0x000001E6F7610000-0x000001E6F7676000-memory.dmp
memory/4608-473-0x00007FF6482F0000-0x00007FF6487F7000-memory.dmp
memory/4608-308-0x00007FF6482F0000-0x00007FF6487F7000-memory.dmp
memory/4608-310-0x00000208ED3A0000-0x00000208ED406000-memory.dmp
memory/4608-309-0x00000208ED3A0000-0x00000208ED406000-memory.dmp
memory/4748-0-0x00000000011F0000-0x0000000001259000-memory.dmp
memory/4748-8-0x00000000011F0000-0x0000000001259000-memory.dmp
memory/4748-5-0x0000000002A70000-0x0000000002BD0000-memory.dmp
memory/4748-6-0x00000000011F0000-0x0000000001259000-memory.dmp
memory/4792-250-0x000001ACA7E40000-0x000001ACA7EA6000-memory.dmp
memory/4792-249-0x000001ACA7E40000-0x000001ACA7EA6000-memory.dmp
memory/4792-248-0x00007FF62E210000-0x00007FF62E3A5000-memory.dmp
memory/4792-318-0x00007FF62E210000-0x00007FF62E3A5000-memory.dmp
memory/5196-512-0x000001EC92980000-0x000001EC92C0B000-memory.dmp
memory/5740-120-0x00007FF670BE0000-0x00007FF670CA9000-memory.dmp
memory/5740-121-0x0000020E924F0000-0x0000020E92556000-memory.dmp
memory/5740-123-0x0000020E924F0000-0x0000020E92556000-memory.dmp
memory/5740-122-0x0000020E924F0000-0x0000020E92556000-memory.dmp
memory/5740-177-0x00007FF670BE0000-0x00007FF670CA9000-memory.dmp
memory/5756-263-0x000002566B560000-0x000002566B5C6000-memory.dmp
memory/5756-270-0x00007FF6A31A0000-0x00007FF6A34C1000-memory.dmp
memory/5756-257-0x000002566B560000-0x000002566B5C6000-memory.dmp
memory/5756-259-0x000002566B560000-0x000002566B5C6000-memory.dmp
memory/5756-258-0x00007FF6A31A0000-0x00007FF6A34C1000-memory.dmp
memory/5832-219-0x00007FF6C8E50000-0x00007FF6C9267000-memory.dmp
memory/5832-316-0x00007FF6C8E50000-0x00007FF6C9267000-memory.dmp
memory/5832-314-0x000001E72D740000-0x000001E72D7A6000-memory.dmp
memory/5832-303-0x00007FF6C8E50000-0x00007FF6C9267000-memory.dmp
memory/5832-221-0x000001E72D740000-0x000001E72D7A6000-memory.dmp
memory/5832-220-0x000001E72D740000-0x000001E72D7A6000-memory.dmp
memory/5932-437-0x00007FF6DBFD0000-0x00007FF6DC4A1000-memory.dmp
memory/5932-304-0x00007FF6DBFD0000-0x00007FF6DC4A1000-memory.dmp
memory/5932-299-0x00000171D0600000-0x00000171D0666000-memory.dmp
memory/5932-298-0x00000171D0600000-0x00000171D0666000-memory.dmp