Overview

overview

7

Static

static

3

2026-09-30...er.exe

windows10-2004-x64

7

2026-09-30...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 08:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_b895c7429513d99e62366750867d71a8_darkgate_elex_mafia_smoke-loader.exe
  • Size 2.3MB
  • Sample260930-j6a15axy7q
  • SHA256 f40ec62c340b4929ac9fefb2800b268cc6cd11181a18682925e281a3f8ab0c92
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 16 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_b895c7429513d99e62366750867d71a8_darkgate_elex_mafia_smoke-loader.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_b895c7429513d99e62366750867d71a8_darkgate_elex_mafia_smoke-loader.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:252
    • C:\Windows\SysWOW64\Msiexec.exe
      Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /q REBOOT="ReallySuppress" PAYLOADINFO="https://www8.deepfreeze.com/|6f628a21-ea91-47e4-a8cc-f277caf08864|0|2|FWAFRC||1790602002|0|||"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5492
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 255058D8DEDE16D17F589D0265D3F66B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4980
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /IM FWAInstallMonitor.exe /F
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        PID:6120
      • C:\ProgramData\FWAInstallMonitor.exe
        "C:\ProgramData\FWAInstallMonitor.exe" /StartMonitor /CreateStartUpMonitorTask /MsiPath "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /Pid 4980
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1712
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:1980
    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_b895c7429513d99e62366750867d71a8_darkgate_elex_mafia_smoke-loader.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_b895c7429513d99e62366750867d71a8_darkgate_elex_mafia_smoke-loader.exe" -r
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4496
      • C:\Windows\SysWOW64\Msiexec.exe
        Msiexec /i "C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi" /q REBOOT="ReallySuppress" PAYLOADINFO="https://www8.deepfreeze.com/|6f628a21-ea91-47e4-a8cc-f277caf08864|0|2|FWAFRC||1790602002|0|||"
        2⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1812

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CloudAgentCleanupHelper.LOG
          • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
          • Size 3KB
          • SHA256 498e0880dc37f772b4a1cba3225b52b4b2e7146c1d273834cdf438149a132d81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CloudAgentCleanupHelper.LOG
          • Path C:\ProgramData\CloudAgentCleanupHelper.LOG
          • Size 9KB
          • SHA256 6a73280cffb95152d838e7e538173d691977bd0e0467f716fa42ad16e00cbe1a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          FWAInstallMonitor.exe
          • Path C:\ProgramData\FWAInstallMonitor.exe
          • Size 612KB
          • SHA256 fecded4fe7f8b94c4e459a10077aae82022321abbc0a6f0eea0de5ec973d2e27
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIa50f0.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSIa50f0.LOG
          • Size 1KB
          • SHA256 e2e03711e4db2b0c5ecc3c670e311ee0d1776e4c710a6094ec0d8cbb661340be
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSIa5759.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSIa5759.LOG
          • Size 3KB
          • SHA256 324980614cb241101f140b247608183501090b810031df6aaaf009ecd0d76ed6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Web Agent_C64.msi
          • Path C:\Users\Admin\AppData\Local\Temp\ProductInstaller\Web Agent_C64.msi
          • Size 8.4MB
          • SHA256 8fd2fa8b53230b568c2f866f2b29149e4f10ffdc0323bb00842e0ca0a54badb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI568D.tmp
          • Path C:\Windows\Installer\MSI568D.tmp
          • Size 57KB
          • SHA256 e1076225eafe4cca82c39a4a7db820e0fd44dd293c9847564346e4bb047214b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI5B80.tmp
          • Path C:\Windows\Installer\MSI5B80.tmp
          • Size 138KB
          • SHA256 69bdcb8dbad5145459bc64ee749e84d9e92171aeff5eea37f2145319c99bdf3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI5C2D.tmp
          • Path C:\Windows\Installer\MSI5C2D.tmp
          • Size 1.1MB
          • SHA256 db907ab7cd5e98c1d7b9cd78773b26e986cce70078d376de0b08ceb5e24e769d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Products.ini
          • Path C:\Windows\Products.ini
          • Size 212B
          • SHA256 ba9f00a96454d9c3dce6ef4cd6a904d3665fa2c10c081e2e14d13fb6a5cb7962
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FWAInstaller_2026-09-30-09-16-27.LOG
          • Path C:\Windows\Temp\FWAInstaller_2026-09-30-09-16-27.LOG
          • Size 2KB
          • SHA256 de1c8c397bdab2678cae12d5ec6ab6db8206d817b5b8656433ab518a252109bc
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FWAInstaller_2026-09-30-09-16-27.LOG
          • Path C:\Windows\Temp\FWAInstaller_2026-09-30-09-16-27.LOG
          • Size 2KB
          • SHA256 af0041854c9effd9319353c4cac8784cedbc9629facfd3c1adfafbd2d8fa94e9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FWAInstaller_2026-09-30-09-16-40.LOG
          • Path C:\Windows\Temp\FWAInstaller_2026-09-30-09-16-40.LOG
          • Size 2KB
          • SHA256 6a1dc49e937ec14c4145b3b89a254285efdaf19fabbd94b64d7f7287f5e583e4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          FWAInstaller_2026-09-30-09-16-40.LOG
          • Path C:\Windows\Temp\FWAInstaller_2026-09-30-09-16-40.LOG
          • Size 2KB
          • SHA256 57f459355107fb6517d3fb9a974a2f878ae8f250e4d6cbb02c5f72d9274d7cec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/2800-131-0x00000207ABEC0000-0x00000207AC864000-memory.dmp
          Download